Worm Hotspots: Explaining Non-Uniformity in Worm Targeting Behavior

摘要: Long after the Blaster, Slammer/Sapphire, and CodeRedII worms caused significant worldwide disruptions, a huge number of infected hosts from these continue to probe Internet today. This paper investigates hotspots (non-uniformities) in targeting behavior important worms. Recent data collected over period month half using distributed blackhole collection infrastructure covering 18 networks including ISPs, enterprises, academic show 75K Blaster hosts, 180K slammer 55K hosts. We discover through detailed analysis how critical flaws side effects lead bias for certain destination address blocks. In particular, we demonstrate three previously unexplored biases: severely restricted initial random seed forcing infection attempts blocks; parameters generator making cycle limited target addresses; widespread use private space dramatically changing distribution A direct consequence biases is that blocks are subjected far more than others. discuss implication on worm simulation modeling, placement sensors, detection quarantine. A. Total Packets B. Unique Source IPs Figure 1: Observations Witty, Slammer, Nimda, all monitored