Characterizing Internet worm spatial-temporal infection structures

Since the Morris worm was released in 1988, Internet worms continue to be one of top security threats. For example, the Conficker worm infected 9 to 15 million machines in early 2009 and shut down the service of some critical government and medical networks. Moreover, it constructed a massive peer-to-peer (P2P) botnet. Botnets are zombie networks controlled by attackers setting out coordinated attacks. In recent years, botnets have become the number one threat to the Internet. The objective of this research is to characterize spatial-temporal infection structures of Internet worms, and apply the observations to study P2P-based botnets formed by worm infection. First, we infer temporal characteristics of the Internet worm infection structure, i.e., the host infection time and the worm infection sequence, and thus pinpoint patient zero or initially infected hosts. Specifically, we apply statistical estimation techniques on Darknet observations. We show analytically and empirically that our proposed estimators can significantly improve the inference accuracy. Second, we reveal two key spatial characteristics of the Internet worm infection structure, i.e., the number of children and the generation of the underlying tree topology formed by worm infection. Specifically, we apply probabilistic modeling methods and a sequential growth model. We show analytically and empirically that the number of children has asymptotically a geometric distribution with parameter 0.5, and the generation follows closely a Poisson distribution. Finally, we evaluate bot detection strategies and effects of user defenses in P2P-based botnets formed by worm infection. Specifically, we apply the observations of the number of children and demonstrate analytically and empirically that targeted detection that focuses on the nodes with the largest number of children is an efficient way to expose bots. However, we also point out that future botnets may self-stop scanning to weaken targeted detection, without greatly slowing down the speed of worm infection. We then extend the worm spatial infection structure and show empirically that user defenses, e.g. , patching or cleaning, can significantly mitigate the robustness and the effectiveness of P2P-based botnets. To counterattack, we evaluate a simple measure by future botnets that enhances topology robustness through worm re-infection.

The potential role of plant oxygen and sulphide dynamics in die-off events of the tropical seagrass, Thalassia testudinum

1 Oxygen and sulphide dynamics were examined, using microelectrode techniques, in meristems and rhizomes of the seagrass Thalassia testudinum at three different sites in Florida Bay, and in the laboratory, to evaluate the potential role of internal oxygen variability and sulphide invasion in episodes of sudden die-off. The sites differed with respect to shoot density and sediment composition, with an active die-off occurring at only one of the sites. 2 Meristematic oxygen content followed similar diel patterns at all sites with high oxygen content during the day and hyposaturation relative to the water column during the night. Minimum meristematic oxygen content was recorded around sunrise and varied among sites, with values close to zero at the die-off site. 3 Gaseous sulphide was detected within the sediment at all sites but at different concentrations among sites and within the die-off site. Spontaneous invasion of sulphide into Thalassia rhizomes was recorded at low internal oxygen partial pressure during darkness at the die-off site. 4 A laboratory experiment showed that the internal oxygen dynamics depended on light availability, and hence plant photosynthesis, and on the oxygen content of the water column controlling passive oxygen diffusion from water column to leaves and belowground tissues in the dark. 5 Sulphide invasion only occurred at low internal oxygen content, and the rate of invasion was highly dependent on the oxygen supply to roots and rhizomes. Sulphide was slowly depleted from the tissues when high oxygen partial pressures were re-established through leaf photosynthesis. Coexistence of sulphide and oxygen in the tissues and the slow rate of sulphide depletion suggest that sulphide reoxidation is not biologically mediated within the tissues of Thalassia. 6 Our results support the hypothesis that internal oxygen stress, caused by low water column oxygen content or poor plant performance governed by other environmental factors, allows invasion of sulphide and that the internal plant oxygen and sulphide dynamics potentially are key factors in the episodes of sudden die-off in beds of Thalassia testudinum . Root anoxia followed by sulphide invasion may be a more general mechanism determining the growth and survival of other rooted plants in sulphate-rich aquatic environments.