[Paper Review] Characterizing Internet Worm Infection Structure

Qian Wang, Zesheng Chen+1 more|arXiv (Cornell University)|Jan 8, 2010

Network Security and Intrusion Detection34 references4 citations

TL;DR

This paper characterizes the infection structure of Internet worms using probabilistic modeling and sequential growth models, revealing that the number of infected hosts per node (children) follows a geometric distribution with parameter 0.5, while generations follow a Poisson distribution. The key finding is that half of infected hosts infect no further hosts, over 98% have ≤5 children, and average path length grows logarithmically with infection size, enabling targeted bot detection with high efficiency.

ABSTRACT

Internet worm infection continues to be one of top security threats and has been widely used by botnets to recruit new bots. In this work, we attempt to quantify the infection ability of individual hosts and reveal the key characteristics of the underlying topology formed by worm infection, i.e., the number of children and the generation of the worm infection family tree. Specifically, we first apply probabilistic modeling methods and a sequential growth model to analyze the infection tree of a wide class of worms. We analytically and empirically find that the number of children has asymptotically a geometric distribution with parameter 0.5. As a result, on average half of infected hosts never compromise any vulnerable host, over 98% of infected hosts have no more than five children, and a small portion of infected hosts have a large number of children. We also discover that the generation follows closely a Poisson distribution and the average path length of the worm infection family tree increases approximately logarithmically with the total number of infected hosts. Next, we empirically study the infection structure of localized-scanning worms and surprisingly find that most of the above observations also apply to localized-scanning worms. Finally, we apply our findings to develop bot detection methods and study potential countermeasures for a botnet (e.g., Conficker C) that uses scan-based peer discovery to form a P2P-based botnet. Specifically, we demonstrate that targeted detection that focuses on the nodes with the largest number of children is an efficient way to expose bots. For example, our simulation shows that when 3.125% nodes are examined, targeted detection can reveal 22.36% bots. However, we also point out that future botnets may limit the maximum number of children to weaken targeted detection, without greatly slowing down the speed of worm infection.

Motivation & Objective

• To understand the micro-level topology of worm infection by analyzing the infection family tree formed by compromised hosts.
• To quantify the infection ability of individual hosts through the number of children (infectious offspring) they produce.
• To model the generational structure of the infection tree and determine how average path length scales with total infections.
• To evaluate whether findings from random-scanning worms generalize to localized-scanning worms.
• To apply structural insights to develop targeted detection methods for P2P botnets such as Conficker C.

Proposed method

• Applied probabilistic modeling and a sequential growth model to derive the joint probability distribution of children and generation in the infection tree.
• Used z-transform and difference equations to analytically derive the expected number of children and generations, showing E[C] = (n−1)/n and E[G] = Hₙ − 1.
• Proved that the number of children asymptotically follows a geometric distribution with parameter 0.5, implying P(C=i) = (1/2)^(i+1).
• Demonstrated that the generation distribution asymptotically follows a Poisson distribution with parameter Hₙ − 1.
• Validated analytical results through simulation and empirical analysis of localized-scanning worms.
• Proposed targeted detection by focusing on nodes with the highest number of children, leveraging the power-law-like tail of the child distribution.

Experimental results

Research questions

• RQ1 What is the statistical distribution of the number of children per infected host in a worm infection tree?
• RQ2 How does the generation (level) of infected hosts distribute, and how does the average path length scale with the total number of infected hosts?
• RQ3 Do the structural properties of random-scanning worms also hold for localized-scanning worms?
• RQ4 Can the infection tree structure be leveraged to design efficient bot detection mechanisms in P2P botnets like Conficker C?
• RQ5 How does limiting the maximum number of children affect the effectiveness of targeted detection?

Key findings

• The number of children per infected host asymptotically follows a geometric distribution with parameter 0.5, meaning 50% of infected hosts infect no further hosts.
• Over 98% of infected hosts have no more than five children, indicating that only a small fraction of hosts drive most of the infection spread.
• The generation of infected hosts follows a Poisson distribution with parameter Hₙ − 1, where Hₙ is the n-th harmonic number.
• The average path length of the infection tree increases approximately logarithmically with the total number of infected hosts.
• Targeted detection focusing on the top 3.125% of nodes by child count can reveal 22.36% of bots in simulations, demonstrating high detection efficiency.
• Future botnets may limit the maximum number of children to evade targeted detection without significantly slowing infection speed.