The quest for multi-headed worms

Van H. Pham, Marc Dacier, Guillaume Urvoy-Keller, Taoufik En-Najjary

Research output: Chapter in Book/Report/Conference proceedingConference contribution

1 Citation (Scopus)

Abstract

In [6], Pouget et al. have conjectured the existence of so-called multi-headed worms and found a couple of them on attack traces collected on a single honeypot. These worms take advantage of several distinct attack techniques to propagate but they use only one of them against a given target. From a victim's viewpoint, they are therefore indistinguishable from the other classical worms that always propagate using the same attack vector or same sequence of attack vectors. This paper aims at confirming the existence of these worms by studying a very large dataset. The validation process led to three important contributions. First, we establish the existence and assess the importance of three distinct classes of attacks seen in the wild. Second, we propose a new method to correlate attack traces time series and apply it to search for multi-headed worms. Third, we offer and discuss results of the analysis of 15 months of data gathered over 28 different platforms located all over the world.

Original languageEnglish
Title of host publicationLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Pages247-266
Number of pages20
Volume5137 LNCS
DOIs
Publication statusPublished - 2008
Externally publishedYes
Event5th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2008 - Paris
Duration: 10 Jul 200811 Jul 2008

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume5137 LNCS
ISSN (Print)03029743
ISSN (Electronic)16113349

Other

Other5th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2008
CityParis
Period10/7/0811/7/08

Fingerprint

Worm
Attack
Time series
Trace
Honeypot
Distinct
Large Data Sets
Correlate
Datasets
Target

ASJC Scopus subject areas

  • Biochemistry, Genetics and Molecular Biology(all)
  • Computer Science(all)
  • Theoretical Computer Science

Cite this

Pham, V. H., Dacier, M., Urvoy-Keller, G., & En-Najjary, T. (2008). The quest for multi-headed worms. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) (Vol. 5137 LNCS, pp. 247-266). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 5137 LNCS). https://doi.org/10.1007/978-3-540-70542-0_13

The quest for multi-headed worms. / Pham, Van H.; Dacier, Marc; Urvoy-Keller, Guillaume; En-Najjary, Taoufik.

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Vol. 5137 LNCS 2008. p. 247-266 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 5137 LNCS).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Pham, VH, Dacier, M, Urvoy-Keller, G & En-Najjary, T 2008, The quest for multi-headed worms. in Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). vol. 5137 LNCS, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 5137 LNCS, pp. 247-266, 5th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2008, Paris, 10/7/08. https://doi.org/10.1007/978-3-540-70542-0_13
Pham VH, Dacier M, Urvoy-Keller G, En-Najjary T. The quest for multi-headed worms. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Vol. 5137 LNCS. 2008. p. 247-266. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). https://doi.org/10.1007/978-3-540-70542-0_13
Pham, Van H. ; Dacier, Marc ; Urvoy-Keller, Guillaume ; En-Najjary, Taoufik. / The quest for multi-headed worms. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Vol. 5137 LNCS 2008. pp. 247-266 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).
@inproceedings{6aad729d64cc4ab1ba2098e824a7324d,
title = "The quest for multi-headed worms",
abstract = "In [6], Pouget et al. have conjectured the existence of so-called multi-headed worms and found a couple of them on attack traces collected on a single honeypot. These worms take advantage of several distinct attack techniques to propagate but they use only one of them against a given target. From a victim's viewpoint, they are therefore indistinguishable from the other classical worms that always propagate using the same attack vector or same sequence of attack vectors. This paper aims at confirming the existence of these worms by studying a very large dataset. The validation process led to three important contributions. First, we establish the existence and assess the importance of three distinct classes of attacks seen in the wild. Second, we propose a new method to correlate attack traces time series and apply it to search for multi-headed worms. Third, we offer and discuss results of the analysis of 15 months of data gathered over 28 different platforms located all over the world.",
author = "Pham, {Van H.} and Marc Dacier and Guillaume Urvoy-Keller and Taoufik En-Najjary",
year = "2008",
doi = "10.1007/978-3-540-70542-0_13",
language = "English",
isbn = "3540705414",
volume = "5137 LNCS",
series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
pages = "247--266",
booktitle = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

}

TY - GEN

T1 - The quest for multi-headed worms

AU - Pham, Van H.

AU - Dacier, Marc

AU - Urvoy-Keller, Guillaume

AU - En-Najjary, Taoufik

PY - 2008

Y1 - 2008

N2 - In [6], Pouget et al. have conjectured the existence of so-called multi-headed worms and found a couple of them on attack traces collected on a single honeypot. These worms take advantage of several distinct attack techniques to propagate but they use only one of them against a given target. From a victim's viewpoint, they are therefore indistinguishable from the other classical worms that always propagate using the same attack vector or same sequence of attack vectors. This paper aims at confirming the existence of these worms by studying a very large dataset. The validation process led to three important contributions. First, we establish the existence and assess the importance of three distinct classes of attacks seen in the wild. Second, we propose a new method to correlate attack traces time series and apply it to search for multi-headed worms. Third, we offer and discuss results of the analysis of 15 months of data gathered over 28 different platforms located all over the world.

AB - In [6], Pouget et al. have conjectured the existence of so-called multi-headed worms and found a couple of them on attack traces collected on a single honeypot. These worms take advantage of several distinct attack techniques to propagate but they use only one of them against a given target. From a victim's viewpoint, they are therefore indistinguishable from the other classical worms that always propagate using the same attack vector or same sequence of attack vectors. This paper aims at confirming the existence of these worms by studying a very large dataset. The validation process led to three important contributions. First, we establish the existence and assess the importance of three distinct classes of attacks seen in the wild. Second, we propose a new method to correlate attack traces time series and apply it to search for multi-headed worms. Third, we offer and discuss results of the analysis of 15 months of data gathered over 28 different platforms located all over the world.

UR - http://www.scopus.com/inward/record.url?scp=49949108188&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=49949108188&partnerID=8YFLogxK

U2 - 10.1007/978-3-540-70542-0_13

DO - 10.1007/978-3-540-70542-0_13

M3 - Conference contribution

SN - 3540705414

SN - 9783540705413

VL - 5137 LNCS

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 247

EP - 266

BT - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

ER -