This paper examines the general behaviour of stealthy worms. In particular, we focus on worms that are designed based on network awareness. We study the case where a worm, instead of aiming to spread as fast as possible and penetrate Intrustion Detection Systems (IDS), aims to avoid IDS and spread with the minimum number of detections. We compare different scanning strategies for this worm, including different combinations of hitlist and random scanning, and how they affect the number of infections and the rate of detected infection attempts. We compare the network-aware worm's behavior to that of the Code Red II worm. Simulations show that scanning worms can generate many fewer detections using localized scanning while maintaining its capability to infect.

, ,
2009 IEEE International Conference on Communications, ICC 2009
Department of Systems and Computer Engineering

Smith, C. (Craig), & Matrawy, A. (2009). A behaviour study of network-aware stealthy worms. Presented at the 2009 IEEE International Conference on Communications, ICC 2009. doi:10.1109/ICC.2009.5198577