Optimal worm-scanning method using vulnerable-host distributions

摘要: Most internet worms use random scanning. The distribution of vulnerable hosts on the internet, however, is highly non-uniform over IP-address space. This implies that scanning wastes many scans invulnerable addresses and more virulent schemes may take advantage non-uniformity a vulnerable-host distribution. Questions then arise as to how attackers exploit such information resulting worm be. These issues provide 'worst-case scenarios'for defenders 'best-case when available. work develops scenario, called importance scanning, which results from sampling in statistics. Importance space according an empirical hosts. An analytical model developed relate infection rate with Importance-Scanning (IS) strategies. Based parameters chosen Witty Code Red worms, experimental show IS can spread much faster than either random-scanning or routing worm. In addition, game-theoretical approach suggests best strategy for scatter applications uniformly entire