[论文解读] Characterizing Internet Worm Infection Structure

Qian Wang, Zesheng Chen+1 more|arXiv (Cornell University)|Jan 8, 2010

Network Security and Intrusion Detection参考文献 34被引用 4

一句话总结

本文通过概率建模和连续增长模型分析互联网蠕虫的感染结构，发现每个节点的感染主机数量（子节点数）服从参数为0.5的几何分布，而代际结构则服从泊松分布。关键发现为：一半的感染主机不再感染其他主机，超过98%的主机子节点数≤5，且平均路径长度随感染规模呈对数增长，从而可实现高效的目标化僵尸主机检测。

ABSTRACT

Internet worm infection continues to be one of top security threats and has been widely used by botnets to recruit new bots. In this work, we attempt to quantify the infection ability of individual hosts and reveal the key characteristics of the underlying topology formed by worm infection, i.e., the number of children and the generation of the worm infection family tree. Specifically, we first apply probabilistic modeling methods and a sequential growth model to analyze the infection tree of a wide class of worms. We analytically and empirically find that the number of children has asymptotically a geometric distribution with parameter 0.5. As a result, on average half of infected hosts never compromise any vulnerable host, over 98% of infected hosts have no more than five children, and a small portion of infected hosts have a large number of children. We also discover that the generation follows closely a Poisson distribution and the average path length of the worm infection family tree increases approximately logarithmically with the total number of infected hosts. Next, we empirically study the infection structure of localized-scanning worms and surprisingly find that most of the above observations also apply to localized-scanning worms. Finally, we apply our findings to develop bot detection methods and study potential countermeasures for a botnet (e.g., Conficker C) that uses scan-based peer discovery to form a P2P-based botnet. Specifically, we demonstrate that targeted detection that focuses on the nodes with the largest number of children is an efficient way to expose bots. For example, our simulation shows that when 3.125% nodes are examined, targeted detection can reveal 22.36% bots. However, we also point out that future botnets may limit the maximum number of children to weaken targeted detection, without greatly slowing down the speed of worm infection.

研究动机与目标

• 通过分析被 compromise 主机形成的感染家族树，理解蠕虫感染的微观拓扑结构。
• 通过衡量单个主机产生的子节点数（传染性后代数）来量化其感染能力。
• 建模感染树的代际结构，并确定平均路径长度随总感染数的缩放关系。
• 评估随机扫描蠕虫的发现结果是否可推广至局部扫描蠕虫。
• 应用结构洞察，为类似Conficker C的P2P僵尸网络设计目标化检测方法。

提出的方法

• 应用概率建模与连续增长模型，推导感染树中子节点数与代际的联合概率分布。
• 使用z变换与差分方程，解析推导子节点数与代际的期望值，证明E[C] = (n−1)/n 且 E[G] = Hₙ − 1。
• 证明子节点数渐近服从参数为0.5的几何分布，即P(C=i) = (1/2)^(i+1)。
• 证明代际分布渐近服从参数为Hₙ − 1的泊松分布。
• 通过模拟与对局部扫描蠕虫的实证分析，验证分析结果。
• 提出通过聚焦于子节点数最多的节点实现目标化检测，利用子节点分布的幂律尾部特性。

实验结果

研究问题

• RQ1 在蠕虫感染树中，每个感染主机的子节点数的统计分布是什么？
• RQ2 感染主机的代际（层级）分布如何？平均路径长度如何随总感染主机数变化？
• RQ3 随机扫描蠕虫的结构特性是否也适用于局部扫描蠕虫？
• RQ4 能否利用感染树结构设计出高效检测P2P僵尸网络（如Conficker C）的机制？
• RQ5 限制最大子节点数如何影响目标化检测的有效性？

主要发现

• 每个感染主机的子节点数渐近服从参数为0.5的几何分布，意味着50%的感染主机不再感染其他主机。
• 超过98%的感染主机子节点数不超过5个，表明仅少数主机驱动了大部分感染传播。
• 感染主机的代际分布服从参数为Hₙ − 1的泊松分布，其中Hₙ为第n个调和数。
• 感染树的平均路径长度随总感染主机数近似呈对数增长。
• 在模拟中，仅聚焦于子节点数排名前3.125%的节点，即可发现22.36%的僵尸主机，证明检测效率极高。
• 未来僵尸网络可能限制最大子节点数以规避目标化检测，而不会显著减慢感染速度。