Flow-level traffic analysis of the Blaster and Sobig worm outbreaks in an Internet backbone

被引：0

作者：

Dübendorfer, T ^{[1
]}

Wagner, A ^{[1
]}

Hossmann, T ^{[1
]}

Plattner, B ^{[1
]}

机构：

[1] ETH, Comp Engn & Networks Lab TIK, Zurich, Switzerland

来源：

DETECTION OF INTRUSIONS AND MALWARE, AND VULNERABILITY ASSESSMENT, PROCEEDINGS | 2005年 / 3548卷

关键词：

D O I：

暂无

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

We present an extensive flow-level traffic analysis of the network worm Blaster.A and of the e-mail worm Sobig.F. Based on packet-level measurements with these worms in a testbed we defined flow-level filters. We then extracted the flows that carried malicious worm traffic from AS559 (SWITCH) border router backbone traffic that we had captured in the DDoSVax project. We discuss characteristics and anomalies detected during the outbreak phases, and present an in-depth analysis of partially and completely successful Blaster infections. Detailed flow-level traffic plots of the outbreaks are given. We found a short network test of a Blaster pre-release, significant changes of various traffic parameters, backscatter effects due to non-existent hosts, ineffectiveness of certain temporary port blocking countermeasures, and a surprisingly low frequency of successful worm code transmissions due to Blaster's multi-stage nature. Finally, we detected many TCP packet retransmissions due to Sobig.F's far too greedy spreading algorithm.

引用

页码：103 / 122

页数：20

共 50 条

[31] GAMPAL: Anomaly Detection for Internet Backbone Traffic by Flow Prediction with LSTM-RNN
Wakui, Taku
Kondo, Takao
Teraoka, Fumio
MACHINE LEARNING FOR NETWORKING (MLN 2019), 2020, 12081 : 196 - 211
[32] Flow-level upstream traffic behavior in broadband access networks: DSL versus broadband fixed wireless
Sinha, A
Mitchell, K
Medhi, D
PROCEEDINGS OF THE 3RD IEEE WORKSHOP ON IP OPERATIONS & MANAGEMENT (IPOM2003), 2003, : 135 - 141
[33] Poisson Shot-Noise Process Based Flow-Level Traffic Matrix Generation for Data Center Networks
Han, Yoonseon
Yoo, Jae-Hyoung
Hong, James Won-Ki
PROCEEDINGS OF THE 2015 IFIP/IEEE INTERNATIONAL SYMPOSIUM ON INTEGRATED NETWORK MANAGEMENT (IM), 2015, : 450 - 457
[34] Flow-Level Performance Analysis of Random Wireless Network using Stochastic Petri Nets
Wang, Huijian
Lei, Lei
Zheng, Kan
2016 23RD INTERNATIONAL CONFERENCE ON TELECOMMUNICATIONS (ICT), 2016,
[35] Measures for detecting network attacks at the aggregate traffic level on high-speed Internet backbone links
Choi, W
Roh, BH
Yoo, SW
Min, SW
SAM '04: PROCEEDINGS OF THE INTERNATIONAL CONFERENCE ON SECURITY AND MANAGEMENT, 2004, : 173 - 176
[36] A novel detection methodology of network attack symptoms at aggregate traffic level on highspeed Internet backbone links
Roh, BH
Yoo, SW
TELECOMMUNICATIONS AND NETWORKING - ICT 2004, 2004, 3124 : 1226 - 1235
[37] GAMPAL: an anomaly detection mechanism for Internet backbone traffic by flow size prediction with LSTM-RNN
Taku Wakui
Takao Kondo
Fumio Teraoka
Annals of Telecommunications, 2022, 77 : 437 - 454
[38] GAMPAL: an anomaly detection mechanism for Internet backbone traffic by flow size prediction with LSTM-RNN
Wakui, Taku
Kondo, Takao
Teraoka, Fumio
ANNALS OF TELECOMMUNICATIONS, 2022, 77 (5-6) : 437 - 454
[39] Sampled traffic analysis by Internet-eXchange-level adversaries
Murdoch, Steven J.
Zielinski, Piotr
PRIVACY ENHANCING TECHNOLOGIES, 2007, 4776 : 167 - +
[40] Supporting features for flow-level packet analysis towards cyber threat detection: A pilot study
Ogu E.C.
Ojesanmi O.A.
Awodele O.
Kuyoro S.O.
International Journal of Information and Computer Security, 2021, 16 (1-2) : 137 - 149

← 1 2 3 4 5 →