See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/228667463

Computer Worms: Architectures, Evasion Strategies, and Detection

Mechanisms

Article · January 2009

CITATIONS READS

19 322

4 authors, including:

Stanley Chow

44 PUBLICATIONS   682 CITATIONS   

SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Software security through diversity View project

All content following this page was uploaded by Stanley Chow on 21 July 2018.

The user has requested enhancement of the downloaded file.

Journal of Information Assurance and Security 4 (2009) 69-83

Computer Worms: Architectures, Evasion

Strategies, and Detection Mechanisms
Craig Smith, Ashraf Matrawy
Department of Systems and Computer Engineering, Carleton University
{csmith,amatrawy}@sce.carleton.ca

Stanley Chow, Bassem Abdelaziz

Alcatel-Lucent Bell Labs
{stanley.chow,bassem.abdelaziz}@alcatel-lucent.com

Abstract: This paper surveys the Internet worms-related literature A. Host based vs Network-based Intrusion Detection Sys-
and how stealthy worm behaviour can be discovered. Discussion is tems (IDS)
provided on the anatomy of worms, specifically covering the mech-
Most of the solutions presented in this report can be de-
anisms by which worms spread, how they are detected, and how
scribed as network-based or host-based. The distinction be-
they may attempt to hide. The paper presents common detection
tween the two is where each is implemented. Host-based so-
mechanisms that we divide based on worm architecture properties.
lutions are implemented on the servers which run the services
Namely, we summarize how worms can be detected at each of the
under scrutiny, and are useful for observing and changing the
following stages: target discovery, while they are being distributed,
way the services operate when threats are detected. Host-
while being activated at the hosts, and when they run their payloads
based solutions can be implemented as modifications to the
(where applicable). We also discuss some attack patterns for famous
network stack, modifications to the operating system, modi-
recent worms. The paper concludes with a discussion on current so-
fications to the application, or even implemented by running
lutions (academic research, commercial products, and open-source
the desired programs within an emulated environment.
tools) to detect worms and a comparative summary of these solu-
tions/tools’ capabilities. Network-based IDS collect data directly from the network,
Keywords: worms, evasion, detection, malware and are installed at gateways between internal networks and
the Internet. At these locations, the network-based IDS can
analyze both incoming and outgoing traffic for malicious
traffic. They can also be placed between subnetworks of
I. Introduction larger organizations, such as between the networks of sep-
arate departments. Some existing host-based and network-
We survey the worm-related literature to highlight worm based IDS are described in Sections VIII and IX.
stealthy behaviour and methods of detecting it. A common
question that arises when discussing worms is What is the B. Anomaly Detection vs Signature detection
difference between a worm and a virus?[57] Both are con-
sidered to be malware and can perform the same malicious Intrusion detection systems fall into two other general cate-
actions. Viruses typically don’t self-propagate, and rely on gories; anomaly detectors and signature detectors. The two
users to activate and transport the virus to a new destina- categories fill different niches. Signature detectors, such as
tion. Worms are generally self-propagating, though the line Snort, Bro and Shield, use pre-generated signatures to de-
between worms and viruses blurs when discussing mass- tect traffic or behaviour that is known to be malicious or un-
mailing viruses, since they self-propagate but usually rely on desirable. The signatures can be either man-made, or au-
the receiving user to activate them [1]. The line also blurs tomatically generated, though in either case, an ideal signa-
when discussing newer all-encompassing malware which in- ture should match only the malicious traffic and no legitimate
clude features from viruses, worms, trojan horses and bot- traffic. Signature detectors can detect known attacks but are
nets, such as Storm [58]. In this paper, the term ‘worm’ is unable to detect new attacks. Since fast-spreading worms
used to describe both worms and viruses, though the focus is can infect most of the Internet before man-made signatures
on those which self-propagate across a network. can be crafted [39], automated signature generating systems
are needed. These signature-generating systems are typically
called anomaly detectors.

Received December 20, 2008 1554-1010 $ 03.50 Dynamic Publishers, Inc.

69
70 Smith and Matrawy

Anomaly detectors detect unusual patterns, or anomalies, in tiple times and to coordinate the scanning of many infected
network traffic or in the behaviour of a running program. The hosts. Staniford et al. [57] suggest a simple implementation
anomaly being detected depends strongly on which anomaly of permutation scanning for a 32-bit address space.
detector is being used. Examples of some current methods Another form of target discovery is localized scanning. An
include detecting segments of executable code, unusual byte attacking host would preferentially scan local network ad-
frequencies, unusual flags in packet headers, packet data be- dresses. Vogt [63] shows that worms using localized scan-
ing used to overwrite the return address within a program and ning can spread faster in the initial stages, but that once a
infrequent sequences of bytes in network traffic. Once an large fraction of vulnerable hosts are infected, the infection
anomaly is detected, most anomaly detectors can then gen- process slows down. One of the attacker’s advantages of
erate a signature which can be used by signature based IDS. scanning in this manner is that once a host behind a firewall
Existing anomaly and signature-based IDS are described in is infected, it can directly infect other hosts without passing
Sections VIII and IX. through the firewall, depending on network topology.
The contributions of this paper can be summarized as fol- Worms can also use a pre-generated list of potential targets,
lows: (a) surveying and analyzing different strategies for de- known as a hit-list, to speed the rate of initial infections. The
tecting worm behaviour at different stages of worm propoga- hit-list usually contains a list of addresses which are likely
tion with emphasis on the stealthy worm cases, and (b) com- running vulnerable services. This hit-list can then be split up
paring existing tools and solutions according to their capabil- and distributed to newly infected hosts. A variant on this idea
ities of detecting different types of worm behaviour. is to distribute an anti-hit list along with the worm which con-
The rest of this paper is organized as follows: Sections II tains a list of networks to avoid scanning [63], [51]. These
through V discuss detection of worms based on different networks could simply be empty and thus be a waste of time
architectural properties [1]. Section VI describes common to attempt to probe, or could be known to harbour network
worm behaviour, with examples of attack patterns. Section telescopes attempting to automatically generate worm signa-
VII discusses techniques worms may take to avoid detec- tures. After exhausting the hit-list, a worm could switch to
tion. Sections VIII and IX describe existing tools that are permutation scanning and avoiding hosts in the anti-hit list.
either sold commercially or developed academically to de- Worms which employ topological scanning gather potential
tect worms. Section X contains a grid which describes which targets from the local machine. This includes the email ad-
tools are effective at detecting or blocking different aspects dresses in a user’s contact list, URLs in the user’s brows-
of worm propagation. ing history. In a similar manner, the worms can query a
metaserver to find potential targets, such as the services pro-
II. Detecting Target Discovery vided by Google, Gamespy or Netcraft, or by querying a
peer-to-peer network or an instant messaging server for vul-
A. Target discovery nerable peers.
A different and less common approach is for the worm to
The process of target discovery or scanning is the process
passively wait for incoming or outgoing connections and ex-
where worms find new hosts to infect and is a characteris-
tract information from these connections to determine new
tic behaviour that worms exhibit which can be detected and
targets [57],[1]. This form of scanning is much slower than
stopped at the network level. A host-based approach could
the previous techniques but can be harder to detect by intru-
also be used, however, detecting target discovery at the net-
sion detection systems (IDS). Two examples are Gnuman [6]
work level would yield more scans since it detects the traffic
and CRClean [21] (described below).
directed at multiple hosts. A detailed discussion on target
discovery by Staniford et al. can be found in [57]. It dis-
B. Detection
cusses
• random scanning The scanning of most worms can be detected by using
anomaly detection. The idea is to put bounds on what is
• permutation scanning
considered ‘normal’ traffic and trigger an alarm when those
• localized scanning bounds are exceeded. Recent high-profile worms have tried
• hit-list scanning to spread as quickly as possible. The anomaly in this case
• topological scanning may be that the infected host is contacting many unique IP
addresses in a short time span, or is receiving too many TCP
• metaserver scanning
RST packets, indicating many failed connection attempts.
• passive scanning Multiple IDS’ are compared in [11], where the IDS’ attempt
The simplest form of scanning is random scanning. The at- to identify scanning hosts.
tacker selects a target at random, probes that target, and then Random, permutation and localized scanning may exhibit
continues the cycle by generating a new random target. Per- both anomalies since they can target the whole IP range and
mutation scanning is an improvement on random scanning, will not know whether the vulnerable service is running at
allowing the attacker to avoid probing the same address mul- each address. Hit-list, topological and metaserver scanning
Computer Worms: Architectures, Evasion Strategies, and Detection Mechanisms 71

are less likely to exhibit the TCP RST packets anomaly, since B. Detection
they have a greater likelihood of targetting a host running the
Worm distribution can be detected with network-based IDS
desired service. Passive scanning is unlikely to show either
which can scan both incoming and outgoing traffic. Since
anomaly, and may potentially only be detectable by means
worm distribution may occur at the same time as target dis-
other than target discovery.
covery (such as with UDP-based worms like Slammer), some
Honeypots are another way to detect scanning hosts. Hon-
worms may be detected by the same mechanisms as ex-
eypots are hosts to which should have no incoming traffic.
plained above in Section II-B. Single-packet UDP worms
When traffic is received by a honeypot, it means that ei-
can spread very quickly [37], and only warrant special atten-
ther someone connected to the honeypot by mistake, or a
tion because of that speed. They can be detected in a manner
worm is attempting to connect. Unless using a comprehen-
similar to other worms.
sive anti-hit list, the random, permutation and localized scan-
In addition to the previously described methods, the contents
ning worms will likely send packets to a honeypot eventually.
of the worm itself can be analyzed when the worm is trans-
The larger the number of addresses feeding the honeypot, the
mitted over the network. A simple worm will send identi-
more quickly scanning hosts will be discovered. However,
cal copies of itself across the network. If many packets are
a larger honeypot, depending on its behaviour, is also more
found to contain identical byte sequences, this may signal
likely to be added to an anti-hit list. Some honeypot systems
the presence of a new worm. EarlyBird [54] operates with
can be set up to respond to traffic sent to an organization’s un-
this strategy and can automatically generate a signature for
used IP addresses. An attacker scanning these organizations
such worms. Encrypted or polymorphic worms would be
would see that an unnaturally high percentage of IP addresses
able to bypass this detection method since there would be
contain hosts and infer that it is running a honeypot. Hit-list,
fewer byte sequences common between each variation of the
topological, metaserver and passive worms are unlikely to be
worm. Section VII-B discusses encrypted and polymorphic
discovered by a honeypot because the hit-list will have been
worms in more detail.
generated using likely-vulnerable hosts, and the metaserver,
Worms requiring a second channel have a higher chance of
topological and passive worms will not include the honey-
being detected since they initiate at least two connections.
pots since honeypots are unannounced and don’t provide any
One problem with developing a worm which uses a second
useful publicly available services.
channel is that firewall rules may prevent the second channel
Another approach is to use network address space random-
communication entirely.
ization [9]. The goal of this approach isn’t to detect the
worms, but rather reduce the usefulness of hitlists by chang-
ing the IP addresses of hosts periodically. Shorter DHCP IV. Detecting Worm Activation
leases and changing IP addresses would lead to fewer valid
hosts in a hitlist after a period of time. With fewer hosts to A. Activation mechanisms
infect, simulations in [9] show that if this approach is imple- Four methods by which worms are activated are discussed by
mented by a small fraction of organizations, the propagation Weaver et al. [1]. They can be
of a worm to 90% of it’s vulnerable population can take twice
• human activated
as long as without address space randomization.
• activated based on human activity
III. Detecting Worm Distribution • activated by a scheduled processes, or
• self activated
A. Distribution mechanisms
Human activated worms need a human to manually exe-
Three main mechanisms for worm distribution are identified cute the worm and are often referred to as viruses. Worms
by Weaver et al. [1]. They can be which are activated when a user clicks on an email, such
• self-carried as the Melissa virus, or which copy infected files onto a
shared folder, such as the Nimda worm, fall into this human-
• embedded, or
activated category. The second worm activation method is
• use a secondary channel human activity-based activated worms, which are activated
Self-carried worms are fully transmitted during the initial by a user’s actions which wouldn’t normally be expected to
communication with the target. Worms that rely on a second execute a worm, such as via a user’s login scripts, or when a
channel, such as the Blaster worm, send the infection in two CD or memory card is inserted into the computer.
stages. The worm first sends a small message which includes Scheduled process activated worms are activated by a legiti-
a small program which will download and run the rest of the mate automated process which hasn’t been properly secured,
worm. The third type is embedded worms, which transmit such as a legitimate program which automatically updates it-
themselves within normal communications channels either self from an infected web server.
by appending themselves to normal messages, or replacing Self activating worms are the most worrisome and begin ex-
normal messages. ecution immediately after being transmitted to the target.
72 Smith and Matrawy

These worms generally exploit a vulnerability in a running with a modem.

application. Buffer overflow vulnerabilities are a common
target, and there have been attempts to detect packets con- B. Detection
taining buffer overflows [71]. Code Red I and II are examples
of self activating worms. Detecting worm payloads (behaviours) can be done by actu-
ally running the worm, either in a simulated or instrumented
B. Detection environment, or by analyzing the instructions and system
calls made by the worm. If running the worm produces be-
Since the activation occurs on the host, only host-based IDS haviours that generate network traffic, that traffic can signify
will be able to detect the activation. Network-based IDS may the presence of a worm, but will only be useful for signature
detect anomalous traffic once the worm has already been ac- generation if the worm attempts to spread. A system such as
tivated. Host-based IDS which monitor system calls, im- the double honeypot, described in section VIII, would detect
plement taint tracking or detect buffer overflows can detect this kind of network traffic.
self-activated worms. IDS which monitor system calls, such
as pH [56] and [52], detect the worm based on unusual se-
quences of system calls. Taint-based IDS such as TaintCheck
VI. Attack Patterns
[41], or Vigilante [20] mark incoming network data with a Identifying worm attack patterns would be similar to identi-
‘taint’ as well as the results of any calculations which oper- fying the behaviour of a worm. There are endless permuta-
ate on the tainted data. These systems detect malicious be- tions of how a worm can behave, limited only by the imagi-
haviour when the return address to a function is overwritten nation of the author of the worm. In practice, the behaviour
by tainted data. Other methods of detecting buffer overflows of the worm is limited to delaying for arbitrarily long peri-
include checking that a function’s return address hasn’t been ods of time and the activities listed in section V. To give a
changed, relying on a modified return address pointing to an flavour of what worm behaviours have been seen in the past,
invalid location, or pointing to invalid instructions. Vigilante a summary of some of the more interesting worms in recent
uses the former and COVERS [32] uses both, and another history are detailed below.
system [16] combines taint analysis with anomaly detection.
The previous techniques work for detecting self-activated • Code Red [38] used a buffer overflow vulnerability to
worms, however may not work for the other three activation infect Microsoft IIS web servers. Code Red would scan
methods. The taint-based IDS and the ones relying on mod- and infect other hosts until the 20th day of the month and
ified return addresses will not detect a worm if it is executed then send a DoS attack to the whitehouse website un-
directly by the user. Host-based antivirus solutions are ef- til the 28th and then become dormant for the remainder
fective at detecting known worms and preventing them from of the month. Some of the infected web servers added
infecting a host. Since antivirus solutions are often signature- the phrase ‘Hacked by Chinese’ to the web pages they
based, they may not detect novel worms for which signatures served. This process would repeat every month, how-
have not yet been created. ever it did not cause very much damage. Code Red was
a memory-resident worm, so it did not persist across re-
V. Detecting Worm Payloads boots.

A. Different forms of worm payloads • Code Red II [38] used the same buffer overflow vul-
nerability as Code Red, but was otherwise completely
The payload of a worm refers to the behaviour or actions different. It first determined if Code Red II was already
taken by the worm. Weaver et al. [1] discuss many types installed, and if not it installed a backdoor, went dor-
of payloads that a worm can contain, which are presented mant for a day and then rebooted the machine. It then
below. began to spread. Installing the backdoor allowed a re-
Worms can allow an attacker to remotely control the infected mote user to execute arbitrary code at a later date.
host. In this case, the attacker can execute arbitrary code
and can cause the infected host to take any desired action. • Nimda [34] used four exploits to infect web servers run-
This could include mounting a DoS attack against a target, ning IIS, IE web browsers and Office 2000 programs.
collecting data from the infected host, such as keylogging, or It infected IIS web servers, which then infected visi-
erasing, modifying or encrypting files on the infected host. tors who use IE. It also copied itself to network drives,
A worm can cause the host to act as a mail relay or a web shared the computer’s folders, and created a guest ac-
proxy. Mail relays are used by spammers to cloak the source count with Administrator privileges. It attached itself to
of spam and web proxies would be used to cloak the source explorer.exe to hide itself. It emailed itself to email ad-
of undesirable websites, such as phishing sites. dresses in the user’s contact list. It was self-modifying,
Worms can also be used to cause physical damage such as re- so hashes wouldn’t identify it. Similar to the Code Red
flashing a host’s BIOS or swamping 911 services by dialling II worm, the Nimda worm allowed remote access to the
Computer Worms: Architectures, Evasion Strategies, and Detection Mechanisms 73

infected host, as well as decreasing the security of that VII. Evasion Strategies
host by sharing the C drive.
In order to spread as widely as possible, worms can either
• Slammer [37] was a fast-spreading worm that contained attempt to propagate quickly in an attempt to outrun the au-
no malicious payload. It was fully contained in a 404- tomated signature generators, or by avoiding the automated
byte UDP packet and used a crippled implementation signature generators entirely by spreading in a covert manner.
of random scanning. It took advantage of a buffer- This section discusses some evasion strategies that worms
overflow vulnerability in SQL Server. can take, such as scanning slowly, using polymorphism or
encryption, blending with normal traffic, and different at-
• Slapper [10] spread by exploiting a vulnerability in tempts the worms can make to mislead signature generators.
the OpenSSL implementation used by the Apache web
server. It scanned for targets by randomly choosing a A. Slow Scanning
network, and then sequentially scanning each IP in that
network. The Slapper worm maintained a P2P network Some strategies for detecting worms rely on worms revealing
of other infected hosts and could be used to anony- themselves by quickly scanning many addresses in a short
mously forward commands from the controller to any time. Solutions such as EarlyBird [54] rely on gathering
infected machine. The commands could cause the in- multiple pieces of similar network traffic before sounding
fected hosts to participate in a denial of service attack an alarm. To reduce the amount of processing and/or the
against arbitrary targets. amount of memory needed, EarlyBird and other approaches
set a threshold at which infrequent or uncommon packets are
• The Witty worm targeted an overflow vulnerability in discarded. If a worm spreads at a slow enough rate such that
eEye’s Internet Security System’s [3] protocol analy- it is always discarded, the automated system will never gen-
sis module for ICQ communications. The worm had a erate a signature and the worm can continue to spread.
large initial population, which suggests the use of a hit- Current research doesn’t seem to be focused on detecting a
list and reached saturation after infecting 12000 hosts in worm based on its speed, but rather by making an anomaly
under 45 minutes. It used random scanning, and alter- detection system so accurate that it can reliably detect a ma-
nated between scanning for new targets and overwriting licious packet the first time it is received. An advanced
random sections of the local hard drive. network-based IDS such as Anagram [68] would be able
to detect the anomalous packets, and any host-based IDS
• Blaster [5][13] exploited a buffer overflow vulnerability such as TaintCheck [41] would be able to detect harmful be-
in the RPC implementations of Windows XP and 2000. haviour in a running service.
Blaster was uploaded to the target in two stages. The
first stage transmitted itself via the RPC vulnerability, B. Polymorphic Worms and Encrypted worms [29]
which then retrieved and executed the rest of the worm.
Blaster was designed to send a SYN flood to window- To evade signature-based IDS, worms may try to modify
supdate.com on certain dates. themselves using either polymorphism, encryption or both.
The idea is that the modified worm will no longer match the
• Conficker [48] was another recent worm. Variants of existing signature and so it will pass through the IDS un-
Conficker would install themselves onto flash drives and detected. Since the polymorphic or encrypted worm must
network shares, but originally used a vulnerability in run to properly infect a host, a host-based IDS will be able
RPC on Windows XP and 2000. Conficker could up- to detect the worm [41]. Any other constants that are re-
date itself by locating updates at regular intervals, or quired in a packet to successfully exploit a vulnerability can
the attacker could push updates to the infected hosts. be detected by most IDS, so a polymorphic and encrypted
worm would not be a useful strategy if the exploit is easily
• Gnuman [6] joined a Gnutella network as a normal node detectable. Such a worm would be detected by either host-
and propagates by tricking users into downloading and or network-based IDS.
executing it. The deception was done by responding A polymorphic worm will modify its code by rearranging
to any search with an infected executable file with the functional blocks of code, by replacing instructions with
same filename as the search phrase. Gnuman did noth- functionally equivalent instructions, or by inserting groups
ing else. of instructions which do not change the behaviour of the pro-
gram, but rather act as padding [29]. Since the code for the
• CRclean (Code-Red Clean) [21] was a proof-of concept worm can change each time it is transmitted, the code of
worm that was never released. It was designed to wait the worm will not match any worm signatures. Polygraph
for attacks from hosts infected with Code Red II and [43](VIII) was designed to detect polymorphic worms. In-
then infect the attacking host, disable Code Red II, and stead of looking for one common byte sequence among pack-
filter out subsequent Code Red II infection attempts. ets, it looks for smaller sequences of common bytes, which
74 Smith and Matrawy

are then used as part of a new signature. of sequences of system calls to determine if a program is sus-
An encrypted worm will generate a random encryption key, picious, and then describe how some system calls calls can
encrypt itself, and then transmit that encrypted version along be used as no-ops. A worm can intersperse its regular sys-
with the key and a short decryptor program. The decryp- tem calls with the no-op system calls in order to avoid IDS
tor program itself can be polymorphic so that the whole exe- which monitor system calls. J. Griffin, et al. [25] propose a
cutable part of the worm can change. Similarly to the poly- host-based system which analyzes the system calls of a pro-
morphic worms, the encrypted and polymorphic portion of gram to automatically determine if any system call sequence
the worm will not be detectable by signature-based IDS. exists in the program which could result in a security breach.
Assuming an encrypted and polymorphic worm which uses Since the tool described in [25] analyses the system calls of
an exploit that has few detectable constants, a host-based IDS an executable, it will not detect buffer overflow attacks.
such as Vigilante [20](VIII) or TaintCheck would be needed
to detect it, or a network-based IDS which looks for payload
anomalies, such as PAYL [69] and Anagram. Both Vigilante D. Misleading signature generators
and TaintCheck detect when code at incorrect addresses are To avoid detection, worms can attempt to deceive the IDSs
being run, and can trace those addresses back to a location which try to generate new signatures. The effectiveness of
in received packets. The data at those locations can be used each approach depends on the IDS that is implemented. The
to generate signatures. PAYL determines whether a packet is approaches include misleading the IDS by
suspicious based on its byte distribution. After receiving a
• causing it to generate useless signatures
few more similar packets, it can generate a signature based
on the longest common substring, or longest common sub- • sending ’allergy attacks’ or other learning attacks
sequence of the similar packets. This common substring or • splitting up packets, or
subsequence would likely be the constant parts of the worm. • overloading the IDS
Perdisci et al. [47] discuss how IDS such as Polygraph can be
C. Blending/Mimicry
fooled into generating signatures which are of no use and al-
Blending attacks, or mimicry attacks occur when a worm at- low worms to avoid being detected. This is one type of learn-
tempts to pass through an IDS without detection by chang- ing attack, other such learning attacks are described in [14].
ing itself or its behaviour to appear similar to normal traffic In order to fool signature generators, the normal infection at-
or normal behaviour. Mimicry approaches, as described in tempt is sent to the target host along with a second (or third)
[29] and [24], can be used to evade network-based IDS such ‘fake’ infection attempt. The fake attempts are crafted such
as PAYL. Both techniques involve giving a worm a learning that they closely match the real infection attempt in many
step before attempting to infect other hosts. The worm would of the ‘polymorphic’ areas of the worm, but not in the in-
analyze local network traffic to generate a normal traffic pro- variant areas of the worm. This approach causes the IDS to
file, and then modify its outgoing traffic to match that normal notice the common bytes in the polymorphic areas and gen-
profile. The IDS PAYL and NETAD [35] each detect changes erate a signature which matches that specific variation of the
in the byte frequency distributions of packets. To avoid these worm, but will fail to identify any other variations of that
IDS, a worm could append filler bytes at the end of packets same worm. The technique discussed in [47] showed that
in order to make the byte frequency distribution match the Polygraph could be evaded 85% of the time on average. Part
normal profile. of this approach relies on knowing or learning some common
Host-based IDS which instrument running processes can de- sequences of bytes in normal traffic. This technique can be
tect worms which send mimicked traffic since the behaviour used to avoid some network-based IDS, but will still be de-
of the executing worm would be the same. Network-based tected by host-based IDS, since the unexpected execution of
IDS such as Anagram [68] can also be used. Anagram was the worm can be detected.
designed specifically to defeat mimicry attacks. Since pre- While the previous learning attack causes IDS to generate
vious mimicry strategies generate packets which match the useless signatures, another learning attack, called a causative
overall statistics of normal network traffic, Anagram subdi- integrity attack [14], can be used to prevent any signature
vides the packets into separate partitions. Normal network from being generated in the first place. This attack is dis-
traffic statistics are determined for each partition. Since the cussed briefly in [68] and in more detail in [53]. The attacks
worm will not know where the bounds of the partitions are, can generally be done in two scenarios: where the original
it will not be able to effectively create a ‘normal’ looking training data contains unkown malicious traffic, and where
packet. an IDS is set to continuously learn from incoming traffic. In
Mimicry can also be used at the host level. Some host-based the latter case, a worm may be able to train the IDS to rec-
IDS, such as pH [56], monitor system calls used by a pro- ognize data from the worm payload as normal traffic. By
gram. D. Wagner and P. Soto [65] describe how a worm sending traffic which successively changes from normal to
could call the system calls in a manner that mimics the pat- worm traffic, an IDS may be gradually convinced that the
tern of normal programs. They describe how pH keeps track worm traffic is legitimate and so it will not generate a sig-
Computer Worms: Architectures, Evasion Strategies, and Detection Mechanisms 75

nature. Another learning attack, called an availability attack, • Autograph [28] is a distributed system for automatically
or ’allergy attack’, could cause the IDS to erroneously block generating worm signatures for Bro and Snort. It is in-
innocuous traffic and lead to the network administrator dis- tended to be installed at the DMZ of edge networks.
abling the IDS. M. Barreno et al. [14] describe how many of The suggested sample implementation classifies traffic
these learning attacks can be prevented, while S. Chung [19] as suspicious if a RST packet was generated inside the
describes how allergy attacks are possible in recent IDS. network, so this will only work if the connection is sym-
They suggest biasing a decision if the data is particularly metric. The idea is that worms will scan many hosts
noisy (regularization), changing the boundary at which traf- which aren’t running the vulnerable service, and will
fic is classified as malicious or not (randomization) and re- generate TCP packets with the RST bit in response to
ducing the information available to the attacker (information the worm’s scanning. Autograph is designed to share
hiding). suspicious sources of traffic with other Autograph hosts.
Since TCP traffic can be fragmented into smaller packets, an
attacker may be able to split up large anomalous worm pack- • ‘Throttling viruses’: A small network or system-level
ets into many small packets which raise no alarms. Many approach to reducing the speed at which worms can
IDS such as EarlyBird and Snort take this into consideration propagate. The idea is to keep a small cache of the most
and attempt to reassemble fragmented packets in order to de- recent connections that were initiated. Each new con-
tect these evasion attempts. nection which connects to a host that isn’t in the cache
An attacker could also mount a denial of service attack gets queued, and the queue is processed at X (˜=1 or
against an IDS in an attempt to overload the IDS such that 2) connections per second. Since worms will generally
it can no longer detect worms. Host-based approaches which try to spread by making connection as quickly as pos-
instrument a running program, such as TaintCheck, are par- sible, most of the new connections will be queued and
ticularly at risk since the running program already runs much processed slowly. [72]
more slowly than normal. IDS designers reduce the like-
• Polygraph [43]: A network-level approach to automat-
lihood of an overloaded IDS by pre-filtering the incoming
ically generating signatures for polymorphic worms.
traffic so that known-good traffic doesn’t unduly burden the
The idea is to detect multiple invariant byte sequences
IDS and by using data structures that require very little mem-
instead of a single large sequence. Polygraph is trained
ory. Snot is a program which was designed to generate large
on some known-good traffic and some likely-malicious
amounts of malicious-seeming traffic. It generates traffic
traffic before being deployed.
based on Snort rules, so is likely to generate large numbers
of alerts on a Snort IDS. A similar approach is described in • Threshold Random Walk (TRW): This method attempts
[45]. to discover worms by their scanning behaviour. It de-
tects scanning IP addresses based on how many des-
tinations are scanned and how many of those connec-
VIII. Academic Approaches tion attempts are rejected or unanswered. The idea is
that legitimate clients are more likely to be looking up
These approaches are described in papers and either attempt
servers using DNS, and will likely succeed in connect-
to identify, slow or stop the spread of worms. Commercial
ing to the desired server, while scanners are more likely
implementations for these approaches, however, are not read-
to be choosing targets randomly, which may not be run-
ily available or not publicized. The network-based intrusion
ning the expected server software. Whether a host is
detection systems are listed at the beginning of the list while
scanning or not can be determined after a host makes 5
host based systems appear at the end.
connection attempts. [27]
• EarlyBird [54] generates Bro and Snort signatures auto- • NETAD [35] is a network-based IDS. It takes the first
matically based on how many sources and destinations 48 bytes of the first few packets (which contains mainly
are sending similar packets. The idea is that when many IP and TCP header information) between a server and
copies of a worm send copies of themselves to infect client. NETAD determines whether a packet is anoma-
other hosts, there will be many hosts sending copies of lous or not based on how ‘novel’ a byte in one of the 48
the worm and many hosts receiving them. EarlyBird first bytes is. The more ‘novel’ bytes the more anoma-
flags packets as suspicious if multiple senders send, lous the packet appears. PHAD, ALAD and LERAD are
and multiple receivers receive similar traffic. EarlyBird briefly discussed in the same paper and seem similar.
keeps a small amount of state to keep track of com-
mon sequences of bytes and generates a signature when • SigFree [71] is a host-based IDS which generates sig-
many IP addresses are sending and receiving these com- natures in traffic that contains long sequences of exe-
mon sequences of bytes. EarlyBird is a network-level cutable code. A common buffer overflow technique is
implementation and was measured to run at line speeds to include a NOP sled (or equivalent instructions) along
of 200Mbps, but can scale higher. with the exploit code to save the attacker from needing
76 Smith and Matrawy

to know the exact address where the exploit code will honeypot is configured such that, by default, it never
be located. Since the sled is by definition executable makes outgoing connections. Any outgoing connec-
code, SigFree can detect packets with long sequences tions are evidence that a worm has taken over the hon-
of executable code and flag them as suspicious. SigFree eypot. Any outgoing connections are redirected to the
is a server- or client-side proxy through which the de- outgoing honeypot for analysis. The paper which de-
sired communications are passed. SigFree seems to be scribes the double honeypot also describes two methods
an extension of Abstract Payload Execution [61], which for generating signatures for polymorphic worms.
is implemented as an Apache module.
• TaintCheck [41] is a host-based IDS which can gener-
• PAYL (PAYLoad Anomaly Detection) [69] [67] is a ate signatures to identify malicious traffic. It does so by
network-based IDS which can generate signatures for running the program of interest in an emulated environ-
malicious traffic. PAYL is initially trained with nor- ment and by considering any incoming data as ‘tainted’.
mal traffic, which gives PAYL the chance to learn the Any calculations derived from that tainted data are also
average distribution of bytes within packets. PAYL considered tainted. When tainted data is used to deter-
learns the distributions for each combination of port and mine the next executable instruction, TaintCheck will
packet length. A distance metric is used to determine consider this malicious and will generate a signature.
how close a packet is to the normal data. If the distance Programs run 1.5 to 30 times slower when TaintCheck
is above a specified threshold, the packet is marked as is used.
suspicious. PAYL also correlates anomalous incoming
• Vigilante [20] is a host-based IDS which generates a
packets with anomalous outgoing packets, for example,
signature that can be verified by other hosts without re-
if a suspicious packet arrives on port i, and the recipient
quiring trust between hosts. An instrumented version
then sends out a similar suspicious packet destined for
of the desired service is run inside a virtual machine
port i on another host, it is likely the result of the host
such that it will trigger alerts either when taint anal-
being infected. This behaviour allows PAYL to detect
ysis has determined that tainted instructions are being
the very early stages of worm propagation. PAYL can
executed, or when code is being executed from mem-
then generate a signature based on the longest common
ory pages marked non-executable. Such an alert would
substring (LCS) or longest common subsequence (LC-
cause Vigilante to generate a signature (or SCA, self-
seq), which can be used in other IDS. There are mul-
certifying alert) describing the offset in the received
tiple variations of PAYL’s strategy, one of which [60]
message which caused the alert. Vigilante is designed
attempts to speed up IDS processing by reducing the
to run as a honeypot with low traffic. Minos [22] is an-
amount of packet data passed to PAYL.
other host-based IDS which operates in a similar man-
• Anagram [68] is a recent network-based IDS which is ner to Vigilante.
designed to detect mimicry attacks and generate signa-
• Shield [66] is a host-based intrusion prevention sys-
tures which can be used by others. Anagram uses two
tem which can prevent remote exploits by modifying
Bloom filters to keep track of normal and bad traffic.
or stopping malicious packets before they reach a vul-
The ‘normal traffic’ Bloom filter is trained using normal
nerable service. Shield uses signatures to detect the
traffic and the ‘bad traffic’ Bloom filter can be generated
malicious packets. Since applying patches usually dis-
from previously generated signatures which match un-
rupts the running service, and patches may not be com-
desirable traffic.
pletely reliable, Shield can be used to prevent known
Anagram searches incoming packets for n-grams (byte exploits without having to restart the running service,
sequences with length n) which either exist or do not allowing the administrator to decide when to apply soft-
exist in its Bloom filters. If either many n-grams from ware patches. Each signature is a small Shield-specific
the ‘bad traffic’, or very few n-grams from the ‘normal program which modifies the malicious packets.
traffic’ filter exist in the packet, that packet is flagged as
malicious. The authors suggest that Anagram could use • Vulnerability-specific execution-based filtering
feedback from a heavily instrumented ‘shadow server’ (VSEF): VSEF [42] is a host-based IDS which
to improve its filters. The authors expect Anagram to can ‘harden’ a program against a specific vulnerability.
be able to handle traffic at 100Mbps while using around The patching works for programs where the source
20MB of memory. code isn’t available and incurs just a small overhead.
To operate, VSEF requires an execution trace of
• The double honeypot [59] is both a network- and host- the program receiving the traffic which included the
based IDS which consists of an inbound honeypot and exploit. This trace is obtained by a fully-instrumented
an outbound honeypot. The inbound honeypot is a high- program somewhere else on the network, for example,
interaction honeypot, meaning that it runs an operat- using TaintCheck. Once VSEF has the trace, it can
ing system and one or more programs. The inbound generate a VSEF filter which can then be sent to other
Computer Worms: Architectures, Evasion Strategies, and Detection Mechanisms 77

servers running the same program. VSEF can then in the network. Host-based IDS can detect malicious traf-
‘harden’ the program by adding code which filters out fic once it has reached a host, and can analyze the contents
the exploit. Hardened programs run between 3 to 14% of encrypted packets and detect when administrative policies
slower when VSEF filters are installed. are changed. Host-based IDS can be disabled if the host is
compromised. The commercial products listed below were
• The shadow honeypot [8] architecture is a host- and chosen because they represent the offerings from well-known
network-based IDS. It contains multiple anomaly de- companies or are frequently referred to. The descriptions of
tectors, such as Abstract Payload Execution (similar to these commercial products are based on marketing material
SigFree) and EarlyBird. These IDS determine whether from each product’s website.
traffic is suspicious, and if it is, the traffic is redirected
to a second ‘shadow’ server which runs an instrumented • LaBrea [33] is A honeypot-like project which attempts
version of the server software. If the shadow server de- to slow scanning worms. It responds to pings and re-
tects an attack, it reverts any changes it made and noti- sponds to SYN packets with SYN-ACK packets, and
fies a filtering component which filters out similar traf- does nothing else. It relies on the attacker waiting for
fic before it arrives at the honeypot. Implementations the TCP connection to time out before continuing to
for both client and server software were created. scan. It can be set up to respond for unused IP addresses.
• pH [56] (process homeostasis) is a host-based IDS • Honeycomb [30] is a honeypot project which automat-
which detects uncommon sequences of system calls. pH ically creates worm signatures based on the traffic that
collects sequences of system calls during its training pe- is captured in the honeypot. Since the honeypot doesn’t
riod, and stores subsequences of six consecutive system advertise any services, any traffic directed to the hon-
calls in a database. A program which generates a se- eypot can be considered to be malicious. It uses a
quence that does not appear in the database is consid- longest-common substring approach to find similarities
ered suspicious and will either be delayed or aborted. in packet payloads. Other honeypot systems include
Many similar host based IDS are referenced in [65]. HoneyTank [62], HoneyStat [23], Collapsar [26], iSink
• COVERS [32] is a host-based IDS which can gener- [73], Potemkin [64], nepenthes [12]. A summary of
ate signatures. COVERS identifies attacks by detect- some of these approaches can be found in [44].
ing buffer overflows, by using address-space random- • Bro [46] is an open-source network based IDS which
ization, and instruction set randomization. It then corre- can detect and take action against malicious traffic. It
lates the attack with the packets involved in the attack, can generate alerts or execute programs which take the
identifies the sections of the packets containing the at- desired action, such as terminating an existing connec-
tack and then generates a signature including this infor- tion or blocking future traffic from a hostile host. Bro
mation. COVERS can be used with programs for which uses rules describing restricted activities, policies for
the source code is not available and runs with a low what activities should generate alerts and signatures to
overhead of under 10%. This technique will not be able determine which action it should take.
to generate specific signatures if the traffic is encoded
or encrypted. Bro is designed to provide real-time notification and to
be extensible and resistant to attack. It is designed to
• Other promising IDS techniques include POSEIDON do so in a high-speed network without dropping pack-
[15], a PAYL-based IDS, Argos [50], a taint-based IDS, ets. Bro relies on libpcap to get packets from the net-
Packet Vaccine [70], a host-base IDS, Sting [40], a taint- work. Bro then generates events from the packets, such
based IDS, SweetBait [49], a honeypot-based IDS, Net- as connection established or connection attempted, and
Bait [18], a honeypot-based IDS, Prospector [55], taint- processes these events using the specified policies or
based honeypot IDS, WormTerminator [17], a polymor- scripts.
phic worm detector IDS, Hamsa [31], a polymorphic
Bro’s signatures are based on regular expressions,
worm detector IDS, and Nemean [74], a signature gen-
which can be generated by automated tools.
erator IDS.
To resist attacks against the IDS, attacks are split into
IX. Available Tools three categories: overload, crash and subterfuge attacks.
Overload attacks attempt to overburden the IDS such
These are tools that are available and can be purchased or that it fails to keep up with incoming packets. Over-
downloaded immediately and put into production. They fall loading Bro is difficult since the attacker will not know
into two categories: honeypots and intrusion detection and when Bro becomes overloaded, and will also not know
prevention systems (IDS). The IDS can be either network- what policy scripts are being run. Crash attacks aim to
based or host-based. Network-based IDS detect malicious disable the IDS, either by exploiting a vulnerability or
traffic and can take action before that traffic reaches the hosts by exhausting resources. Bro resists these by running a
78 Smith and Matrawy

watchdog process which terminates Bro when it detects X. A Comparison

when Bro is executing too slowly. Whenever Bro is ter-
minated, either by the watchdog process or from a crash, The grid below contains a list of products or approaches and
tcpdump is started to continue logging any packets. lists whether each can detect or prevent existing worms, new
worms, slow scanning worms, polymorphic or encrypted
• Snort [4] is an open-source network based IDS similar worms and worms using mimicry techniques. The ‘train-
to Bro. The detection rules to detect malicious traffic ing required’ column specifies whether the product needs to
can be specified either as regular expressions or using be trained on sample data before the system can be used.
Snort’s built-in rule description language. The actions The ‘requires multiple samples’ column specifies whether
Snort can take in response to malicious traffic is limited the system detects a worm only after it receives multiple sam-
to logging, alerting and changing iptable’s rules to block ples of that worm. The ‘speed’ column contains information
traffic. Though less powerful than Bro’s ability to run about how the system performs. The rate of network traffic
arbitrary commands, Snort’s available actions provide the system can handle is specified when available, otherwise
the needed functionality of an IDS. Depending on the ‘fast’ or ‘slow’ is included. The products are used within
speed of the machine and Snort’s configuration, Snort small to large enterprises. Existing papers do not cover the
can process traffic at gigabit speeds. behaviour of products at the ISP level.

• The Cisco Security Agent [2] is a host-based IDS. Ver- XI. Concluding Remarks
sions of the client software are available for Windows,
This paper is an attempt to give a complete picture of the
Solaris and Red Hat, in both server and desktop ver-
anatomy of computer worms, of how worms’ behaviour can
sions. The management software which coordinates
be stealthy, and of how to detect that behaviour. We dis-
with all of the agents handles up to 100,000 agents per
cussed a number of issues that range from detection at differ-
management host. The software can add information to
ent infection stages to evasion and detection strategies. Also
outgoing packets which can be used by Cisco routers for
a number of tools and research approaches have been dis-
QoS purposes. Cisco’s IPS 4200 systems are network-
cussed.
based IDS which operate at up to 1Gbps.
Despite the significant efforts by the research and develop-
ment communities, the situation is far from perfect. Solu-
• TippingPoint [7] is a division of 3COM and offers a
tions exist to thwart the worms, but aren’t necessarily practi-
range of network-based IDS. It uses customized ASICs
cal for small businesses to implement. As a matter of fact, a
to scan traffic at up to 3 Gbps. It can detect zero-
new generation of worms is already spreading and starting to
day worms and also uses signatures to detect previous
accumulate bots by the millions while the tradition signature-
worms. The signatures are provided by TippingPoint’s
based tools are having trouble keeping up.
‘Digital Vaccine’ service. TippingPoint’s 5000E device
The change in motivation (from fame to cash) appears to be
passed ICSA Labs’ intrusion prevention system evalua-
driving innovations in malware. We expect the monetary re-
tion [36].
wards to grow. The research and development communities
need to be prepare for more innovative attacks and avenues
• Host-based firewalls: Popular firewall solutions in- that will attempt to monetize the infected machines.
clude ZoneAlarm, Windows Firewall, BlackICE prod-
ucts, Norton Personal Firewall, and Comodo Personal
Firewall. There are many others, and each may scan Acknowledgment
incoming and outgoing traffic for malicious packets This work is part of a project funded by Ontario Centers of
and/or prevent unexpected incoming and outgoing con- Excellence and Alcatel-Lucent Canada.
nections.

• Host-based anti-virus: Popular antivirus solutions in-

clude Grisoft’s AVG, Norton Antivirus, Kaspersky
Anti-virus, ALWIL Software’s Avast, and CA Anti-
virus. There are many others, and each will usually
provide services such as ‘resident protection’, periodic
scanning and on-demand scanning for files, running
programs, email attachments, instant messaging pro-
grams, etc. These products identify viruses and worms
either via signature matching or by using heuristics.
Since these are installed on the host, they can poten-
tially be disabled by worms and viruses.
Computer Worms: Architectures, Evasion Strategies, and Detection Mechanisms 79

green = good, red = bad, yellow = in between

Existing Novel Slow Polymorphic / Mimicry Training Re- Requires Speed

Worms Worms Scanning Encrypted quired Multiple
Samples
Host Firewall Yes Yes Yes Yes Yes No No Fast
Incoming and outgoing connec-
tions are never established.
Host Antivirus Yes No n/a Yes n/a No No Fast
Honeycomb Yes Yes No No Yes(3) No Yes Unk.
Bro/Snort Yes No Unknown Unknown Unknown No No Varies
Cisco(1) Yes Yes Unknown Unknown Unknown Unknown Unknown 2Gbps
TippingPoint(1) Yes Yes Unknown Unknown Unknown Unknown Unknown 3Gbps
EarlyBird Yes Yes No No No No Yes 200+ Mbps
Autograph Yes Yes No No No Yes Yes Unk.
Polygraph Yes Yes No Yes No Maybe Yes Unk.
another system
pre-classifies
incoming traf-
fic, could use
pre-training.
TRW Yes Yes No Yes Yes No Yes Fast
Contents of
packets not
analyzed, so
content mimicry
doesn’t affect
detection.
NETAD Some Some Some Some(2) No Yes No Unk.
SigFree Yes Yes Yes Some No No No 100 Mbps
SigFree will likely perform
poorly if it is analyzing traffic
which normally transfers
executable files.
PAYL Yes Yes Yes Yes(2) No Yes No Fast
Anagram Yes Yes Yes Yes(2) Yes Yes No Fast
TaintCheck Yes Yes Yes Yes Yes No No Slow
Vigilante Yes Yes Yes Yes Yes(3) No No Slow
Shield Yes No Yes Yes Yes No No 350 Mbps
Requires Shield is targeted to
a human- the vulnerability not
generated the worm.
signature.
Double Honeypot Yes Yes Yes Some Yes(3) No Yes Unk.
VSEF Yes Yes Yes Yes Yes No No Fast
Shadow Honeypot Yes Yes Yes Yes Maybe(4) Maybe(4) Maybe(4) 1Gbps
pH Yes(5) Yes(5) Yes(5) Yes(5) No Yes No Fast
COVERS Yes Yes Yes Yes Yes No No Fast

1. Claimed in marketing material.

2. Not likely if normal traffic contains large amount of encrypted traffic.
3. Since this is a honeypot, any traffic arriving is suspicious. Mimicry will not work in this case.
4. Depends on the anomaly detectors being used.
5. Yes, unless an attacker specifically attempts to avoid this type of detection.
80 Smith and Matrawy

References [12] Paul Baecher, Markus Koetter, Thorsten Holz, Max-

imillian Dornseif, and Felix C. Freiling. The Nepenthes
[1] N. Weaver and V. Paxson and S. Staniford, and R. Platform: An Efficient Approach to Collect Malware.
Cunningham. A Taxonomy of Computer Worms. In In Recent Advances in Intrusion Detection, 9th Inter-
The First ACM Workshop on Rapid Malcode (WORM), national Symposium, RAID 2006, Hamburg, Germany,
2003. 11. pages 165–184, 2006.
[2] Cisco Systems Inc’s Cisco Security Agent web- [13] Michael Bailey, Evan Cooke, Farnam Jahanian, David
site. Available at http://www.cisco.com/en/ Watson, and Jose Nazario. The Blaster Worm: Then
US/products/sw/secursw/ps5057/index.html, viewed and Now. IEEE Security and Privacy, 03(4):26–31,
May, 2009. 2005.

[3] eEye Digital Security’s SecureIIS. Available at [14] Marco Barreno, Blaine Nelson, Russell Sears, An-
http://www.eeye.com/html/products/secureiis/ in- thony D. Joseph, and J. D. Tygar. Can machine learn-
dex.html, viewed May, 2009. ing be secure? In ASIACCS ’06: Proceedings of the
2006 ACM Symposium on Information, computer and
[4] Snort User Manual 2.8.4. Available from communications security, pages 16–25, New York, NY,
http://www.snort.org/docs/snort htmanuals/ htman- USA, 2006. ACM Press.
ual 284/, viewed May, 2009.
[15] Damiano Bolzoni, Sandro Etalle, Pieter Hartel, and
[5] Symantec summary of Emmanuele Zambon. POSEIDON: a 2-tier Anomaly-
W32.Blaster.Worm. Available at based Network Intrusion Detection System. In IWIA
http://securityresponse.symantec.com/avcenter/venc/ ’06: Proceedings of the Fourth IEEE International
data/w32.blaster.worm.html, viewed May, 2009. Workshop on Information Assurance (IWIA’06), pages
144–156, Washington, DC, USA, 2006. IEEE Com-
[6] Symantec summary of puter Society.
W32.Gnuman.Worm. Available at
http://www.symantec.com/security response/writeup.jsp [16] Lorenzo Cavallaro and R. Sekar. Anomalous Taint De-
?docid=2001-022710-3046-99, viewed May, 2009. tection. Technical Report SECLAB08-06, Stony Brook
University, 2008.
[7] 3COM’s TippingPoint IDS website.
http://www.tippingpoint.com/products ips.html, [17] Songqing Chen, Xinyuan Wang, Lei Liu, and Xinwen
viewed May, 2009. Zhang. WormTerminator: an effective containment of
unknown and polymorphic fast spreading worms. In
[8] K. G. Anagnostakis, S. Sidiroglou, P. Akritidis, ANCS ’06: Proceedings of the 2006 ACM/IEEE sym-
K. Xinidis, E. Markatos, and A. D. Keromytis. Detect- posium on Architecture for networking and communi-
ing targeted attacks using shadow honeypots. In Pro- cations systems, pages 173–182, New York, NY, USA,
ceedings of the 14th conference on USENIX Security 2006. ACM Press.
Symposium, pages 129–144, 2005.
[18] B. N. Chun, J. Lee, and H. Weatherspoon. Netbait: a
[9] S. Antonatos, P. Akritidis, E. P. Markatos, and K. G. Distributed Worm Detection Service. Technical Report
Anagnostakis. Defending against hitlist worms using IRB-TR-03-033, Intel Research Berkeley, September
network address space randomization. In WORM ’05: 2003.
Proceedings of the 2005 ACM workshop on Rapid mal-
code, pages 30–40, New York, NY, USA, 2005. ACM [19] Simon P. Chung and Aloysius K. Mok. Advanced Al-
Press. lergy Attacks: Does a Corpus Really Help? In Re-
cent Advances in Intrusion Detection, 10th Interna-
[10] Iván Arce and Elias Levy. An Analysis of the Slapper tional Symposium, RAID 2007, Queensland, Australia,
Worm. IEEE Security and Privacy, 1(1):82–87, 2003. pages 236–255, 2007.

[11] Ayesha Binte Ashfaq, Maria Joseph Robert, Asma [20] Manuel Costa, Jon Crowcroft, Miguel Castro, Antony
Mumtaz, Muhammad Qasim Ali, Ali Sajjad, and Rowstron, Lidong Zhou, Lintao Zhang, and Paul
Syed Ali Khayam. A Comparative Evaluation of Barham. Vigilante: end-to-end containment of inter-
Anomaly Detectors Under Portscan Attacks. In Recent net worms. In SOSP ’05: Proceedings of the twen-
Advances in Intrusion Detection: 11th International tieth ACM symposium on Operating systems princi-
Symposium, RAID 2008, Cambridge, Massachussets, ples, pages 133–147, New York, NY, USA, 2005. ACM
U.S.A., pages 351–371, 2008. Press.
Computer Worms: Architectures, Evasion Strategies, and Detection Mechanisms 81

[21] S. Coursen. Good viruses have a future. Avail- [31] Zhichun Li, Manan Sanghi, Yan Chen, Ming-Yang
able at http://www.securityfocus.com/columnists/23, Kao, and Brian Chavez. Hamsa: Fast Signature Gener-
viewed May, 2009. ation for Zero-day Polymorphic Worms with Provable
Attack Resilience. In SP ’06: Proceedings of the 2006
[22] Jedidiah R. Crandall, Shyhtsun Felix Wu, and Fred- IEEE Symposium on Security and Privacy (S&P’06),
eric T. Chong. Experiences Using Minos as a Tool for pages 32–47, Washington, DC, USA, 2006. IEEE Com-
Capturing and Analyzing Novel Worms for Unknown puter Society.
Vulnerabilities. In Proceedings of Detection of Intru-
sions and Malware, and Vulnerability Assessment, Sec- [32] Zhenkai Liang and R. Sekar. Fast and automated gen-
ond International Conference (DIMVA), pages 32–50, eration of attack signatures: a basis for building self-
2005. protecting servers. In CCS ’05: Proceedings of the
12th ACM conference on Computer and communica-
[23] David Dagon, Xinzhou Qin, Guofei Gu, Wenke Lee, tions security, pages 213–222, New York, NY, USA,
Julian B. Grizzard, John G. Levine, and Henry L. 2005. ACM Press.
Owen. HoneyStat: Local Worm Detection Using Hon-
eypots. In Recent Advances in Intrusion Detection: 7th [33] T. Liston. LaBrea: “Sticky” Honeypot and IDS.
International Symposium, RAID 2004, Sophia Antipo- http://labrea.sf.net, viewed May, 2009.
lis, France, pages 39–58, 2004.
[34] Andrew Mackie, Jensenne Roculan, Ryan Russell, and
[24] Prahlad Fogla and Wenke Lee. Evading network Mario Van Velzen. Nimda Worm Analysis. September
anomaly detection systems: formal reasoning and prac- 2001. ARIS predictor, Attack Registry & Intelligence
tical techniques. In CCS ’06: Proceedings of the 13th Service, Incident Analysis Report Version 2, Security-
ACM conference on Computer and communications se- Focus.
curity, pages 59–68, New York, NY, USA, 2006. ACM
Press. [35] Matthew V. Mahoney. Network traffic anomaly detec-
tion based on packet bytes. In SAC ’03: Proceedings of
[25] Jonathon T. Giffin, Somesh Jha, and Barton P. Miller.
the 2003 ACM symposium on Applied computing, pages
Automated Discovery of Mimicry Attacks. In Re-
346–350, New York, NY, USA, 2003. ACM Press.
cent Advances in Intrusion Detection, 9th International
Symposium, RAID 2006, Hamburg, Germany, pages [36] E. Messmer. Three IPS products pass
41–60, 2006. security evaluation tests. Available at
http://www.networkworld.com/news/2006/062606-
[26] Xuxian Jiang and Dongyan Xu. Collapsar: a vm-based
ips-tests.html. Viewed May, 2009.
architecture for network attack detention center. In Pro-
ceedings of the 13th conference on USENIX Security
[37] David Moore, Vern Paxson, Stefan Savage, Colleen
Symposium, pages 15–28, 2004.
Shannon, Stuart Staniford, and Nicholas Weaver. In-
[27] Jaeyeon Jung, Vern Paxson, Arthur W. Berger, and Hari side the Slammer Worm. IEEE Security and Privacy,
Balakrishnan. Fast Portscan Detection Using Sequen- 1(4):33–39, 2003.
tial Hypothesis Testing. In IEEE Symposium on Secu-
rity and Privacy 2004, pages 212–225, Oakland, CA, [38] David Moore, Colleen Shannon, and Jeffery Brown.
May 2004. Code-Red: a case study on the spread and victims of
an Internet worm. In Proceedings of the Internet Mea-
[28] Hyang-Ah Kim and Brad Karp. Autograph: Toward surement Workshop (IMW), pages 273–284, 2002.
Automated, Distributed Worm Signature Detection. In
USENIX Security Symposium, pages 271–286, 2004. [39] David Moore, Colleen Shannon, Geoffrey M. Voelker,
and Stefan Savage. Internet Quarantine: Require-
[29] Oleg Kolesnikov and Wenke Lee. Advanced Polymor- ments for Containing Self-Propagating Code. In Pro-
phic Worms: Evading IDS by Blending in with Normal ceedings of the 22th IEEE International Conference on
Traffic. Technical Report GIT-CC-05-09, College of Computer Communications (INFOCOM 2003)., pages
Computing, Georgia Tech, 2005. 1901–1910, 2003.

[30] Christian Kreibich and Jon Crowcroft. Honeycomb [40] J. Newsome, D. Brumley, and D. Song. An End-to-
- Creating Intrusion Detection Signatures Using Hon- End Self-healing System for Defending against Zero-
eypots. In Proceedings of the Second Workshop on day Worm Attacks on Commodity Software. Technical
Hot Topics in Networks (Hotnets II), Boston, Novem- Report CMU-CS-05-191, Carnegie Mellon University,
ber 2003. February 2006.
82 Smith and Matrawy

[41] J. Newsome and D. Dong. Dynamic Taint Analysis for Challenges Ahead. In Recent Advances in Intrusion
Automatic Detection, Analysis, and Signature Genera- Detection, 9th International Symposium, RAID 2006,
tion of Exploits on Commodity Software. In The 12th Hamburg, Germany, pages 206–225, 2006.
Annual Network and Distributed System Security Sym-
posium, 2 2005. [52] Sanjay Rawat, V.P. Gulati, Arun K. Pujari, and V. Rao
Vemuri. Intrusion Detection Using Text Process-
[42] James Newsome, David Brumley, and Dawn Xiaodong ing Techniques with a Binary-Weighted Cosine Met-
Song. Vulnerability-Specific Execution Filtering for ric. Journal of Information Assurance and Security,
Exploit Prevention on Commodity Software. In Net- 1(1):43–50, 2006.
work and Distributed Security Symposium (NDSS),
2006. [53] Benjamin I.P. Rubinstein, Blaine Nelson, Ling Huang,
Anthony D. Joseph, Shing hon Lau, Nina Taft, and
[43] James Newsome, Brad Karp, and Dawn Song. Poly- Doug Tygar. Compromising PCA-based Anomaly De-
graph: Automatically Generating Signatures for Poly- tectors for Network-Wide Traffic. Technical Report
morphic Worms. In Proceedings of the 2005 IEEE Sym- UCB/EECS-2008-73, UC Berkeley, May 2008.
posium on Security and Privacy, pages 226–241, Wash-
ington, DC, USA, 2005. IEEE Computer Society. [54] Sumeet Singh, Cristian Estan, George Varghese, and
Stefan Savage. Automated Worm Fingerprinting. In
[44] European Network of Affined Honeypots. D0.1: Sur- 6th Symposium on Operating Systems Design and Im-
vey on the state-of-the-Art. http://www.fp6-noah.org/, plementation (OSDI ’04), pages 45–60, 2004.
2005.
[55] A. Slowinska, G. Portokalidis, and H. Bos. Prospector:
[45] Samuel Patton, William Yurcik, and David Doss. a protocol-specific detector of polymorphic buffer over-
An Achilles’ Heel in Signature-Based IDS: Squealing flows. Technical Report IR-CS-023, Vrije Universiteit
False Positives in SNORT. In Proceedings of RAID, Amsterdam, June 2006.
2001.
[56] Anil Somayaji and Stephanie Forrest. Automated re-
[46] Vern Paxson. Bro: a system for detecting network in- sponse using system-call delays. In Proceedings of the
truders in real-time. Computer Networks (Amsterdam, 9th conference on USENIX Security Symposium, pages
Netherlands: 1999), 31(23–24):2435–2463, 1999. 185–198, 2000.
[47] Roberto Perdisci, David Dagon, Wenke Lee, Prahlad [57] Stuart Staniford, Vern Paxson, and Nicholas Weaver.
Fogla, and Monirul Sharif. Misleading Worm Signa- How to 0wn the Internet in Your Spare Time. In Pro-
ture Generators Using Deliberate Noise Injection. In ceedings of the 11th USENIX Security Symposium (Se-
SP ’06: Proceedings of the 2006 IEEE Symposium on curity ’02), pages 149–167, 2002.
Security and Privacy (S&P’06), pages 17–31, Wash-
ington, DC, USA, 2006. IEEE Computer Society. [58] Sam Stover, Dave Dittrich, John Hernandez, and Sven
Dietrich. Analysis of the Storm and Nugache Trojans:
[48] Phillip Porras, Hassen Saidi, and Vinod Yegneswaran. P2P is Here. In The USENIX Magazine, volume 32,
An Analysis of Conficker’s Logic and Rendezvous pages 18–27. December 2007.
Points. Technical report, SRI International, March
2009. http://mtc.sri.com/Conficker/, viewed May, [59] Yong Tang and Shigang Chen. Defending against In-
2009. ternet worms: A signature-based approach. In Pro-
ceedings of the 24th IEEE International Conference on
[49] Georgios Portokalidis and Herbert Bos. SweetBait: Computer Communications (INFOCOM 2005)., pages
Zero-hour worm detection and containment using low- 1384–1394, 2005.
and high-interaction honeypots. Computer Networks:
The International Journal of Computer and Telecom- [60] Sandeep A. Thorat, Amit K. Khandelwal, Bezawada
munications Networking, 51(5):1256–1274, 2007. Bruhadeshwar, and K. Kishore. Anomalous Packet De-
tection using Partitioned Payload. Journal of Informa-
[50] Georgios Portokalidis, Asia Slowinska, and Herbert tion Assurance and Security, 3(3):195–202, 2008.
Bos. Argos: an emulator for fingerprinting zero-
day attacks for advertised honeypots with automatic [61] Thomas Toth and Christopher Krügel. Accurate Buffer
signature generation. In Proceedings of the ACM Overflow Detection via Abstract Payload Execution. In
SIGOPS/Eurosys European Conference on Computer Fifth Internation Symposium on Recent Advances in In-
Systems, pages 15–27, Leuven, Belgium, April 2006. trusion Detection (RAID), pages 274–291, 2002.

[51] Moheeb Abu Rajab, Fabian Monrose, and Andreas [62] N. Vanderavero, X. Brouckaert, O. Bonaventure, and
Terzis. Fast and Evasive Attacks: Highlighting the B. Le Charlier. The HoneyTank: a scalable approach to
 View publication stats

Computer Worms: Architectures, Evasion Strategies, and Detection Mechanisms 83

collect malicious Internet traffic. International Journal [72] M. Williamson. Throttling Viruses: Restricting Prop-
of Critical Infrastructures, 4(1):185–205, 2008. agation to Defeat Malicious Mobile Code. Technical
Report HPL2002-172, HP Laboratories Bristol, 2002.
[63] T. Vogt. Simulating and optimizing worm
propagation algorithms,, 2003. Available from [73] Vinod Yegneswaran, Paul Barford, and David Plonka.
http://downloads.securityfocus.com/library/ Worm- On the Design and Use of Internet Sinks for Network
Propagation.pdf. Abuse Monitoring. In Recent Advances in Intrusion
Detection: 7th International Symposium, RAID 2004,
[64] Michael Vrable, Justin Ma, Jay Chen, David Moore, Sophia Antipolis, France, pages 146–165, 2004.
Erik Vandekieft, Alex C. Snoeren, Geoffrey M.
Voelker, and Stefan Savage. Scalability, fidelity, [74] Vinod Yegneswaran, Jonathon T. Giffin, Paul Bar-
and containment in the potemkin virtual honeyfarm. ford, and Somesh Jha. An Architecture for Generat-
SIGOPS Oper. Syst. Rev., 39(5):148–162, 2005. ing Semantics-Aware Signatures. In Proceedings of
the 14th conference on USENIX Security Symposium,
[65] David Wagner and Paolo Soto. Mimicry attacks on pages 97–112, 2005.
host-based intrusion detection systems. In CCS ’02:
Proceedings of the 9th ACM conference on Computer
and communications security, pages 255–264, New Author Biographies
York, NY, USA, 2002. ACM Press.
Craig Smith completed his M.Eng at Carleton University
[66] Helen J. Wang, Chuanxiong Guo, Daniel R. Simon, and in Ottawa, Canada. His areas of interest include network
Alf Zugenmaier. Shield: vulnerability-driven network security, networked applications, pattern classification and
filters for preventing known vulnerability exploits. In cryptography. Ashraf Matrawy received the B.Sc. and
SIGCOMM ’04: Proceedings of the 2004 conference M.Sc. degrees in computer science and automatic control
on Applications, technologies, architectures, and pro- from Alexandria University, Egypt, and the Ph.D. degree in
tocols for computer communications, pages 193–204, electrical engineering from Carleton University, Ottawa, ON,
New York, NY, USA, 2004. ACM Press. Canada. Ashraf is currently an Assistant Professor at Car-
leton University. He is a senior member of the IEEE, serves
[67] Ke Wang, Gabriela Cretu, and Salvatore J. Stolfo. on the editorial board of the IEEE Communications Surveys
Anomalous Payload-Based Worm Detection and Sig- and Tutorials journal, and has served as a technical program
nature Generation. In Recent Advances in Intrusion committee member of a number of IEEE and other interna-
Detection: 8th International Symposium (RAID), pages tional conferences. Ashraf’s research interests include reli-
227–246, 2005. able and secure computer networking, and analysis of Inter-
[68] Ke Wang, Janak J. Parekh, and Salvatore J. Stolfo. net traffic.
Anagram: A Content Anomaly Detector Resistant to Stanley Chow works in the Enabling Computing Technol-
Mimicry Attack. In Recent Advances in Intrusion De- ogy domain of Bell Lab. He received his B.Sc. from Uni-
tection, 9th International Symposium (RAID), Ham- versity of British Columbia. His work experience include
burg, Germany, pages 226–248, 2006. telephony systems, ATM systems, silicon CAD/CAM, IT
systems, tamper- resistant software, DRM, network secu-
[69] Ke Wang and Salvatore J. Stolfo. Anomalous Payload- rity. His research interests include security in general (in-
Based Network Intrusion Detection. In Recent Ad- cluding network and software), software engineering, real-
vances in Intrusion Detection: 7th International Sym- time systems, and algorithms. He co-founded a software se-
posium, RAID 2004, Sophia Antipolis, France, pages curity company (that has since been acquired). He is cur-
203–222, 2004. rently concentrating on bringing together research and prod-
ucts. He is a Senior Member of IEEE and holds PMP, CISSP
[70] XiaoFeng Wang, Zhuowei Li, Jun Xu, Michael K. Re- and SANS GAWN certifications. Bassem AbdelAziz has a
iter, Chongkyung Kil, and Jong Youl Choi. Packet vac- Bachelor degree in Electrical Engineering from Mansura U.
cine: black-box exploit detection and signature genera- (1993), and a Master of Applied Science degree from Ot-
tion. In CCS ’06: Proceedings of the 13th ACM confer- tawa U (2003). He is a member IEEE, and a member of the
ence on Computer and communications security, pages Professional Engineers Ontario (PEO). Bassem has over fif-
37–46, New York, NY, USA, 2006. ACM Press. teen years of experience in software engineering, computer
networks, signal processing, and network security. He holds
[71] Xinran Wang, Chi-Chun Pan, Peng Liu, and Sencun several granted and pending patents, and has published pa-
Zhu. SigFree: a signature-free buffer overflow attack pers on multimedia security, malware detection, and network
blocker. In USENIX-SS’06: Proceedings of the 15th security. Bassem is currently a senior software engineer at
conference on USENIX Security Symposium, pages Trillys Systems.
225–240, 2006.