Understanding Localized-Scanning Worms

— Localized scanning is a simple technique used by attackers to search for vulnerable hosts. Localized scanning trades off between the local and the global search of vulnerable hosts and has been used by Code Red II and Nimda worms. As such a strategy is so simple yet effective in attacking the Internet, it is important that defenders understand the spreading ability and behaviors of localized-scanning worms. In this work, we first characterize the relationships between vulnerable-host distributions and the spread of localized-scanning worms through mathematical modeling and analysis, and compare random scanning with localized scanning. We then design an optimal localized-scanning strategy, which provides an upper bound on the spreading speed of localized-scanning self-propagating codes. Furthermore, we construct three variants of localized scanning. Specifically, the feedback localized scanning and the ping-pong localized scanning adapt the scanning methods based on the feedback f...

• Type: Conference
• Year: 2007
• Where: IPCCC
• Authors: Zesheng Chen, Chao Chen, Chuanyi Ji
• Keywords: Communications, IPCCC 2007, Localized Scanning, Ping-pong Localized Scanning, Vulnerable Hosts