On the Effectiveness of Distributed Worm Monitoring Moheeb Abu - - PowerPoint PPT Presentation

▶

Sep 14, 2022 258 likes •512 views

On the Effectiveness of Distributed Worm Monitoring Moheeb Abu Rajab Fabian Monrose Andreas Terzis Computer Science Department Johns Hopkins University 1 Monitoring Internet Threats Threat monitoring techniques: Intrusion detection

SLIDE 1

On the Effectiveness of Distributed Worm Monitoring

Moheeb Abu Rajab Fabian Monrose Andreas Terzis

Computer Science Department Johns Hopkins University

SLIDE 2

Monitoring Internet Threats

Threat monitoring techniques:

Intrusion detection systems monitoring active

networks

Monitoring routable unused IP space [ Moore et al,

2002 ]

Monitoring unused address space is attractive

No legitimate traffic Forensic analysis and early warning

CAIDA deployed the first /8 telescope

SLIDE 3

Single Monitor Case

Worm Scans DoS Attack

DoS Attack DoS Backscatter Worm Scans

SLIDE 4

Size Matters!

Size of the monitor is an important factor

in providing an accurate view of a worm breakout [Moore et al, 2002]

But there are several other factors yet to

be explored

SLIDE 5

Single monitor view is too limited

Worm Scans DoS Attack

Non-uniform scanner

SLIDE 6

Goals

Provide a model to evaluate the

performance of distributed monitoring systems in terms of:

Number of monitors? Sizes of monitors and the overall IP space

requirements?

Provide guidelines for better design and

monitor deployment practices.

SLIDE 7

Outline

Problem and Motivation A Worm Propagation Model

Population Distribution Extended worm model

Distributed Worm Monitoring

Distributed Telescope Model Design parameters

Summary

SLIDE 8

Why another worm model?

Previous worm models assumed that the

vulnerable population is uniformly distributed

ver the whole IP space.

Sources of non-uniformity in population

distribution

Un-allocated address space Highly-clustered allocated space Usage of the allocated space

SLIDE 9

Population distribution

The distribution of Vulnerable population over the IP space is far from uniform Best fits a Log-normal distribution DShield dataset CAIDA’s dataset (Witty Worm)

SLIDE 10

Extended Worm Propagation Model

Worm propagation models must

incorporate population density distribution.

Especially Non-uniform scanning worms:

Probability of scanning a host depends on its

location relative to the infected scanner

SLIDE 11

Non-uniform worm propagation model

Expected number of scans per /16 subnet

216 28 - 216 232 - 28 P16 P8 P0

32 16 24 16 ) 8 (/ 8 16

2 2 2 2

i i j i j i

n s p b s p b s p k + + =

ni bi

(/8)

bi vi

SLIDE 12

Non-uniform worm propagation model

The expected number of infected hosts

per /16 subnet (AAWP Model [Chen et al,2003])

The expected total infection

⎥ ⎥ ⎦ ⎤ ⎢ ⎢ ⎣ ⎡ ⎟ ⎠ ⎞ ⎜ ⎝ ⎛ − − − + =

j i

k j i i j i j i

b v b b

16 1

2 1 1 1 ) (

∑

= + =

2 1 1 j j i i

b n

Vulnerable non- infected hosts

SLIDE 13

Impact of population distribution

N= 106 hosts uniformly distributed Over the IP space Number of Infected hosts vs time, for a Nimda-like worm s= 100 scans/time tick, P16= 0.5, P8=0.25, P0 = 0.25 N= 620,000 hosts extracted from DShield data set

SLIDE 14

Outline

Problem and Motivation Better Worm Model

Population Distribution Extended worm model

Distributed Worm Monitoring

Distributed monitoring system model Design parameters

Summary

SLIDE 15

Using the Model--- Distributed Monitoring:

What do we want to evaluate?

System detection time: the time it takes the

monitoring system to detect (with particular confidence) a new scanner.

SLIDE 16

Assumptions

Single scan detection Information sharing and aggregation

infrastructure among all monitors.

SLIDE 17

Monitors Logical Hierarchy

/0 /16 /8 MB MC MB MC /8 MA M

S(/8) = MB+ MC S(/0) = M + MA+ MB+ MC

MA P16 P8 P0

S(/16) = MC

SLIDE 18

Evaluation

Nimda-like scanner Three Monitor deployment scenarios:

Random monitor deployment Full knowledge of population distribution Partial population knowledge

SLIDE 19

Evaluation (Random monitor placement)

Random Monitor placement Pr= 0.999, s= 10 scans/time tick Nimda-like scanning

/8 940 time ticks 512 /17 230 time ticks with only 40 hosts per /16, 7100 more scans will cause infecting 2 victims before being detected

SLIDE 20

Evaluation ( Full vulnerable distribution knowledge)

Monitors deployed in top populated prefixes

512 /17 9 time ticks /8 940 time ticks

SLIDE 21

Evaluation (Partial Knowledge )

512 /17 33 time ticks /8 940 time ticks

Monitors deployed randomly over the 5000 most populated /16 prefixes (contain 90% of the vulnerable population) Example: 512 monitors with 2048 IP addresses/monitor 160 time ticks

SLIDE 22

Practical Considerations

Monitors will be deployed at different

administrative domains.

How many domains are needed to deploy these

512 monitors?

Mapping the monitors to AS space, only 130

AS’s among the top address space owners are required to achieve detection time of 160 time ticks

SLIDE 23

Summary

Population distribution has a profound impact on worm

propagation speed.

Distributed Monitoring provides an improved detection

time (three times faster than a single monitor of equivalent size).

Even partial knowledge of the population distribution can

improve detection time by roughly 30 times.

Effective distributed monitoring is possible with

cooperation among top address space owners.

SLIDE 24

On the Effectiveness of Distributed Worm Monitoring

Moheeb Abu Rajab Fabian Monrose Andreas Terzis

Monitoring Internet Threats

networks

2002 ]

Single Monitor Case

Size Matters!

Size of the monitor is an important factor

in providing an accurate view of a worm breakout [Moore et al, 2002]

But there are several other factors yet to

be explored

Single monitor view is too limited

Goals

Provide a model to evaluate the

performance of distributed monitoring systems in terms of:

Number of monitors? Sizes of monitors and the overall IP space

requirements?

Provide guidelines for better design and

monitor deployment practices.

Outline

Why another worm model?

vulnerable population is uniformly distributed

distribution

Population distribution

Extended Worm Propagation Model

Worm propagation models must

incorporate population density distribution.

Especially Non-uniform scanning worms:

Probability of scanning a host depends on its

location relative to the infected scanner

Non-uniform worm propagation model

Expected number of scans per /16 subnet

2 2 2 2

n s p b s p b s p k + + =

Non-uniform worm propagation model

The expected number of infected hosts

per /16 subnet (AAWP Model [Chen et al,2003])

The expected total infection

⎥ ⎥ ⎦ ⎤ ⎢ ⎢ ⎣ ⎡ ⎟ ⎠ ⎞ ⎜ ⎝ ⎛ − − − + =

b v b b

2 1 1 1 ) (

∑

b n

Impact of population distribution

Outline

Using the Model--- Distributed Monitoring:

What do we want to evaluate?

System detection time: the time it takes the

monitoring system to detect (with particular confidence) a new scanner.

Assumptions

Single scan detection Information sharing and aggregation

infrastructure among all monitors.

Monitors Logical Hierarchy

Evaluation

Nimda-like scanner Three Monitor deployment scenarios:

Random monitor deployment Full knowledge of population distribution Partial population knowledge

Evaluation (Random monitor placement)

Evaluation ( Full vulnerable distribution knowledge)

Evaluation (Partial Knowledge )

Practical Considerations

administrative domains.

512 monitors?

AS’s among the top address space owners are required to achieve detection time of 160 time ticks

Summary

propagation speed.

time (three times faster than a single monitor of equivalent size).

improve detection time by roughly 30 times.

cooperation among top address space owners.

Questions?