[ Pobierz całość w formacie PDF ]
.Previ-So, the HoneyStat analysis provides the following in- ous activity included incoming port 80 and 8080 scans,sights: First, how many honeypots were compromised, and some very distant activity on port 135 outside of theand in what time frame.Second, whether factors appear- sample range.As a single observation could concludeing in many of the events can be eliminated.(E.g., port that port 80 explains the honeypots activities.But with139 and 445 look hot , but there are too many obser- just one observation, there s not enough data to drawvations where these ports are silent.) Third, what fac- such a conclusion.As it turns out, this particular hon-tors (ranked) can explain odds changes in the honeypot eypot was infected days earlier, and used on-and-off forstate.Instead of merely issuing an alert (e.g., you ve IRC relay, scanning, and testing malware.When this ob-got worms ) the HoneyStat analysis suggests a possible servation is added to the other honeypot events, it doesinfection vector (e.g., there s a worm, and with X con- not significantly influence the outcome.fidence, the worm enters on port Y and targets on portZ ).In our example, the HoneyStat analysis reports with Admittedly, the data set we analyzed had a few fortunatesome confidence that a worm is using port 135 to infect occurrences the honeypots all reacted to the worm, anda number of machines.minimal noise was discarded from the infection modelby the logit analysis.To reliably reproduce this for fu-Statistical analysis, of course, can be erroneous, partic- ture worms, one must deploy a sizeable number of min-ularly for small sample values.Without an exhaustive imal honeypots.Using strategies such as virtual ma-data set to test HoneyStat, we can speculate about fail- chines and large multihoming, one can efficiently spanure conditions.First, when attackers flood the network a suitable address space.The size of the data collectionwith tremendous amounts of extraneous traffic to con- required to provide early detection is no different thanfound analysis.In such a scenario, however, attack- the needs of DSC (see Section 4) or any other algorithm.ers will have to sacrifice bandwidth needed for wormpropagation.Second, when worms take a tremendousamount of time to download an egg , thereby delayingthe trigger event for the worm.Recall that we noted a6 Conclusion and Future Workshort period of time between the buffer overflow and thetransfer of the complete worm.If attackers stretch thistime period out, it would certainly add more noise to theIn this study, we reviewed some of the monitoring strate-sample space.However, it would also significantly slowgies used for large networks.The need for a global mon-the progress of the worm itself, since infection could notitoring system is clear.Likewise, the need for local de-complete until the payload is obtained.Hanging wormstection and response is also obvious.However, manyalso face attritional factors such as reboots, restarts, andof the strategies are difficult to apply to local networks.the management of hung programs that do not seem toIn particular, the Kalman filter and victim number-basedreturn from function calls.Future work may model thisapproaches can be difficult to manage on smaller net-factor, but we see it as a challenge for worm writers toworks.overcome.We propose two algorithms tailored for local network16 monitoring needs.First, the DSC algorithm focuses on [7] J.O.Kephart and S.R.White.Directed-graph epi-the infection relation, and tracks real infected hosts (and demiological models of computer viruses.In Pro-not merely scans) to provide an accurate response.Sec- ceedings of IEEE Symposium on Security and Pri-ond, the HoneyStat system provides a way to track the vacy, pages 343 359, 1991.short-term infection behavior used by worms.Poten-[8] J.O.Kephart and S.R.White.Measuring and mod-tially, this may provide a basis for statistical inferenceeling computer virus prevalence.In Proceedings ofabout a worm s behavior on a network.IEEE Symposium on Security and Privacy, 1993.We examined all of these algorithms in light of a large[9] C.Kruegel and G.Vigna
[ Pobierz całość w formacie PDF ]