On the trade-off between stealth and propagation speed of Internet worms

Abstract

Internet worms pose major security threats for networks and users. This is due to their ability of self-spreading and self-replicating. In this paper, we introduce a new type of Internet worms, called Non-Overlapping Camouflaging worm (NOC-worm). It is an intelligent worm that makes a trade-off between stealth and propagation speed on the Internet. NOC-worm is different from traditional worms, because it controls its overall scan rate and avoids redundant scanning of the same hosts. Various scanning methods have different impacts on worm propagation models. An accurate propagation model helps us to comprehensively study how a worm spreads under various conditions which are computationally too heavy for simulation. Standard worm propagation models, such as SI and SIR, consider random scanning. Therefore, they cannot accurately model the inherent characteristics of NOC-worm appropriately. Hence, we extend SIR to model the NOC-worm's propagation behavior and analyze its characteristics. Our results show that NOC-worm can achieve a better trade-off between stealth and propagation speed on the Internet in comparison to other stealthy worms.