Modeling the Co-evololution DNS Worms and Anti-worms in IPv6 Networks

A computer worm is an autonomous malicious, selfreplicating and propagating piece of code that is able to spread fast in computer networks, exploiting the vulnerabilities it discovers at network components. Lately, an interest has arisen for worms that propagate using information from Domain Name Servers (DNS) in order to discover hosts that they will infect. These worms generate random strings, as possible network domain names, and then query Domain Name Servers in order to discover the IP address, in the case that the randomly generated string represents a real host address. In this paper we present models for capturing the dynamics of the co-evolution of worm agents in the presence of anti-worm agents that move in the network in order to locate and stop worm propagation. The proposed models consider anti-worm agents who know the network and, thus, know the IP addresses that they should visit and anti-worm agents that do not know the network and need to issue DNS queries in order to...

• Type: Conference
• Year: 2009
• Where: IEEEIAS
• Authors: Pantelis Kammas, Thodoros Komninos, Yannis C. Stamatiou
• Keywords: Anti-worm Agents, Domain Name Servers, IEEEIAS 2009, Information Technology, Worm