User perceptions and acceptance of benevolent worms - a matter of fear?

Worms and other forms of malware have been considered by IT Security firms and large companies for many years as one of the leading threats to the integrity of their data and security. However, several researchers over recent years have been working on creating worms which, instead of causing harm to machines which they infect, or the networks on which the machines reside, actually aid the network and systems administrators. Several uses of these worms have been proposed by these researchers, including, but not limited to, rapid remote patching of machines, network and system administration through use of their unique discovery and propagation methods, actively hunting, and defending against, other forms of malware such as "malevolent" worms, viruses, spyware, as well as increasing reliable communication of nodes in distributed computing. However, there has been no hint of commercial adoption of these worms, which one researcher has described as being due to a fear factor'. This paper concentrates on assessing and delivering the findings of user attitudes towards these worms in an attempt to find out how users feel about these worms, and to try and define and overcome the factors which might contribute to the fear factor'.

Modeling the propagation of peer-to-peer worms

Propagation of Peer-to-Peer (P2P) worms in the Internet is posing a serious challenge to network security research because of P2P worms' increasing complexity and sophistication. Due to the complexity of the problem, no existing work has solved the problem of modeling the propagation of P2P worms, especially when quarantine of peers is enforced. This paper presents a study on modeling the propagation of P2P worms. It also presents our applications of the proposed approach in worm propagation research.

Motivated by our aspiration to invent an easy-to-employ instrument for worm propagation research, the proposed approach models the propagation processes of P2P worms by difference equations of a logic matrix, which are essentially discrete-time deterministic propagation models of P2P worms. To the best of our knowledge, we are the first using a logic matrix in network security research in general and worm propagation modeling in particular.

Our major contributions in this paper are firstly, we propose a novel logic matrix approach to modeling the propagation of P2P worms under three different conditions; secondly, we find the impacts of two different topologies on a P2P worm's attack performance; thirdly, we find the impacts of the network-related characteristics on a P2P worm's attack performance in structured P2P networks; and fourthly, we find the impacts of the two different quarantine tactics on the propagation characteristics of P2P worms in unstructured P2P networks. The approach's ease of employment, which is demonstrated by its applications in our simulation experiments, makes it an attractive instrument to conduct worm propagation research.

Modeling worms propagation on probability

There are the two common means for propagating worms: scanning vulnerable computers in the network and sending out malicious email attachments. Modeling the propagation of worms can help us understand how worms spread and devise effective defence strategies. Most traditional models simulate the overall scale of infected network in each time tick, making them invalid for examining deep inside the propagation procedure among individual nodes. For this reason, this paper proposes a novel probability matrix to model the propagation mechanism of the two main classes of worms (scanning and email worms) by concentrating on the propagation probability. The objective of this paper is to access the spreading and work out an effective scheme against the worms. In order to evaluate the effects of each major component in our probability model, we implement a series of experiments for both worms. From the results, the network administrators can make decision on how to reduce the number of vulnerable nodes to a certain threshold for scanning worms, and how to immunize the highly-connected node for preventing worm's propagation for email worms.

Locating defense positions for thwarting the propagation of topological worms

A common view for the preferable positions of thwarting worm propagation is at the highly connected nodes. However, in certain conditions, such as when some popular users (highly connected nodes in the network) have more vigilance on the malicious codes, this may not always be the truth. In this letter, we propose a measure of betweenness and closeness to locate the most suitable positions for slowing down the worm propagation. This work provides practical values to the defense of topological worms.

Modeling and defense against propagation of worms in networks

Worms are widely believed to be one of the most serious challenges in network security research. In order to prevent worms from propagating, we present a microcosmic model, which can benefit the security industry by allowing them to save significant money in the deployment of their security patching schemes.

Dossier Chris Marker : the suffering image

Dossier Chris Marker: The Suffering Image is a study of a late-modern chiasmus, impersonal-personal agency, as it comes to expression in the works of French artist and filmmaker, Chris Marker, as the dynamic interplay of political and subjective agency. As chiasmus, the complementary halves of this often-apocalyptic dynamis (a semi-catastrophic, temporal or historical force-field) also – arguably – secretly agree to meet, through the work of art, in the futural. Consistent with the classical figure of concordia discors, these irreducible warring aspects of life experience are, in fact, resolved in an atemporal and ahistorical moment that inhabits the work of art from its inception. This redemptive aspect in art is also the ultimate gesture of the artwork as “mask” or “screen” for forces that reside beyond the frame of the image or work, as its proverbial Other, or within the frame, as other to that Other. A topological “knot,” or ontological “problem,” it is this very conflict that animates all of Marker’s extensive works – filmic and otherwise.

An analytical model on the propagation of modern email worms

Email worms propagate across networks by taking advantage of email relationships. Modeling the propagation of email worms can help predict their potential damages and develop countermeasures. We propose a novel analytical model on the propagation process of modern reinfection email worms. It relies on probabilistic analysis, and thus can provide a steady and reliable assessment on the propagation dynamics. Additionally, by introducing virtual users to represent the repetitious spreading process, the proposed model overcomes the computational challenge caused by reinfection processes. To demonstrate the benefits of our model, we conduct a series of experimental evaluation. The results show that our novel approach achieves a greater accuracy and is more suitable for modeling modern email worms than previous models.

Modeling propagation dynamics of social network worms

Social network worms, such as email worms and facebook worms, pose a critical security threat to the Internet. Modeling their propagation dynamics is essential to predict their potential damages and develop countermeasures. Although several analytical models have been proposed for modeling propagation dynamics of social network worms, there are two critical problems unsolved: temporal dynamics and spatial dependence. First, previous models have not taken into account the different time periods of Internet users checking emails or social messages, namely, temporal dynamics. Second, the problem of spatial dependence results from the improper assumption that the states of neighboring nodes are independent. These two problems seriously affect the accuracy of the previous analytical models. To address these two problems, we propose a novel analytical model. This model implements a spatial-temporal synchronization process, which is able to capture the temporal dynamics. Additionally, we find the essence of spatial dependence is the spreading cycles. By eliminating the effect of these cycles, our model overcomes the computational challenge of spatial dependence and provides a stronger approximation to the propagation dynamics. To evaluate our susceptible-infectious-immunized (SII) model, we conduct both theoretical analysis and extensive simulations. Compared with previous epidemic models and the spatial-temporal model, the experimental results show our SII model achieves a greater accuracy. We also compare our model with the susceptible-infectious-susceptible and susceptible-infectious- recovered models. The results show that our model is more suitable for modeling the propagation of social network worms.

A data mining approach for detection of self-propagating worms

In this paper we demonstrate our signature based detector for self-propagating worms. We use a set of worm and benign traffic traces of several endpoints to build benign and worm profiles. These profiles were arranged into separate n-ary trees. We also demonstrate our anomaly detector that was used to deal with tied matches between worm and benign trees. We analyzed the performance of each detector and also with their integration. Results show that our signature based detector can detect very high true positive. Meanwhile, the anomaly detector did not achieve high true positive. Both detectors, when used independently, suffer high false positive. However, when both detectors were integrated they maintained a high detection rate of true positive and minimized the false positive

Opening up a can of worms: how do decision-makers decide when witnesses are telling the truth?

Correctly determining witness credibility is integral to a fair trial. Assessments of credibility made by the triers of fact are made, amongst other things, by reference to behavioural stereotypes that are commonly thought to be associated with lying and truth-telling. These stereotypes are worthless but pervasive. In this study, potential jurors were given information such as would be given by way of judicial direction and/or expert testimony on those behavioural indicia that are useful in detecting deception. Major changes in perceptions of what does and does not work were found. This has significant implications for the conduct of criminal trials. Recommendations are presented which, it is argued, can be of real, practical, assistance in enabling decision-makers to assess the credibility of witnesses. © 2013 The Australian and New Zealand Association of Psychiatry, Psychology and Law.

Modeling the propagation of worms in networks: a survey

There are the two common means for propagating worms: scanning vulnerable computers in the network and spreading through topological neighbors. Modeling the propagation of worms can help us understand how worms spread and devise effective defense strategies. However, most previous researches either focus on their proposed work or pay attention to exploring detection and defense system. Few of them gives a comprehensive analysis in modeling the propagation of worms which is helpful for developing defense mechanism against worms' spreading. This paper presents a survey and comparison of worms' propagation models according to two different spreading methods of worms. We first identify worms characteristics through their spreading behavior, and then classify various target discover techniques employed by them. Furthermore, we investigate different topologies for modeling the spreading of worms, analyze various worms' propagation models and emphasize the performance of each model. Based on the analysis of worms' spreading and the existing research, an open filed and future direction with modeling the propagation of worms is provided. © 2014 IEEE.