Defeat scanning worms in cyber warfare

NCU Institutional Repository > 資訊電機學院 > 資訊工程學系 > 期刊論文 > Item 987654321/106571

請使用永久網址來引用或連結此文件: https://ir.lib.ncu.edu.tw/handle/987654321/106571

題名:	Defeat scanning worms in cyber warfare
作者:	許富皓;Hsu, Fu-Hau;Chen, Li-Han;Lin, Chia-Jun
貢獻者:	資訊電機學院資訊工程學系
關鍵詞:	Chains;computer crime;Mathematical models;network security;Serums;Spreads;Strings;system security;Ticks;Traffic engineering;Traffic flow;worm;Worms
日期:	2015-03-25
上傳時間:	2026-04-23 13:29:07 (UTC+8)
出版者:	Hindawi Limited;London: Blackwell Publishing Ltd
摘要:	摘要： In this paper, we propose an automatic defense system, called Serum System, against scanning worms. The homeland security department of a country can use Serum System to protect its Internet infrastructure. When an infecting host is infecting a Serum System host, called Serum System Server (SSS), the SSS automatically replaces the shellcode inside the infecting string with its code (called serum code) and then uses the modified string (called serum string) to counterattack the infecting host and takes control of it. The serum code transforms the infecting host into a Serum System Client (SSC) that has the same functions as the SSS and is immune to the same worm. Therefore, infecting hosts attacking SSSs or SSCs will transform themselves into SSCs. We implemented Serum System on Linux and also built a mathematical model for Serum System to analyze its effectiveness and bandwidth savings. Our analyses show that with only a small number of SSSs and through chain counterattacks, Serum System can automatically and rapidly defeat related infected hosts. Compared with white worms whose spread cannot be controlled, Serum System only spreads on infected hosts. The amount of accumulative traffic saved by Serum System at time tick 450 reached 90%. Copyright © 2014 John Wiley & Sons, Ltd. Our analyses show that with only a small number of SSSs and through chain counterattacks, Serum System can automatically and rapidly defeat related infected hosts. Compared with white worms whose spread cannot be controlled, Serum System only spreads on infected hosts. The amount of accumulative traffic saved by Serum System at time tick 450 reached 90%. 其他題名： Security Comm. Networks 出版者： London: Blackwell Publishing Ltd 出版日期： 2015-03-25 出處： Security and communication networks, 2015-03, Vol.8 (5), p.715-726 版權： Copyright © 2014 John Wiley & Sons, Ltd. 版權： Copyright © 2015 John Wiley & Sons, Ltd. 識別號： ISSN: 1939-0114 識別號： EISSN: 1939-0122 識別號： DOI: 10.1002/sec.1019
顯示於類別:	[資訊工程學系] 期刊論文

文件中的檔案:

檔案	描述	大小	格式	瀏覽次數
index.html		0Kb	HTML	15	檢視/開啟

在NCUIR中所有的資料項目都受到原著作權保護.

社群 sharing

資料載入中.....