Evolutionary Proactive P2P Worm: Propagation Modeling and Simulation
Yejiang Zhang, Zhitang Li, Zhengbing Hu, Qingfeng Huang, Chuiwei Lu
College of Computer Science and Technology
Huazhong University of Science and Technology
zyj@mail.hust.edu.cn
Abstract
Computer worms evolved continually, faster and
smarter. Proactive P2P worms with new “gene”
propagate over logical P2P overlay networks defined
by peer relationship. Observations suggest that the
node degrees of an unstructured P2P network are
power law distributed thus we model it as a power law
undirected graph. We study propagation process of
proactive P2P worm using a dynamic epidemic model.
Specifically, we adopt discrete-time to conduct
recursive analysis and deterministic approximation to
describe propagation of proactive P2P worm. Then we
carry out extensive simulation studies, which prove
that the mathematical model matches simulation
results well.
1. Introduction
Computer worms evolved quickly to be able to
propagate through P2P networks as P2P networks
became more and more popular. Their “gene” and
intelligence keep developing. And finally, there comes
new specie, P2P worm. P2P worm may first
compromise client machines, and then propagate by
scanning IP addresses [1], harvesting email addresses,
discovering P2P neighbors from those victims, or
carried in shared files.
Among them hides the most dangerous killer,
proactive P2P worm, which is our focus in this paper.
Today’s Internet worms such as Slammer may infect
millions of machines in minutes, and proactive P2P
worms could propagate even faster.
Proactive P2P worm exploits neighborhood
information from the overlay to locate new targets for
system-wide propagation. The worm first exploits
software vulnerability and controls one peer, and then
explores the connectivity information from the
unprotected routing table/neighbor set in this victim
and chooses those active neighbors as new targets.
Compared with an IP scanning worm that randomly
probes IP addresses to discover new targets, a
proactive P2P worm does not need such interactions.
Thus, it is not likely to be detected by an IDS and will
be more accurate in target seeking and faster in
propagation. Although no instance of a proactive worm
has been witnessed in a real P2P network, there are
strong evidences that such worms could happen. For
example, worms have been reported to exploit the
buffer overflow vulnerability in FastTrack, KaZaA,
iMesh and other P2P client programs to launch denial-
of-service attacks on super nodes and potentially other
machines [2].
Like earthquake modeling or tornado modeling, a
good model of proactive P2P worm gives us deep
understanding of proactive P2P worms, helps us
evaluate the effectiveness of defense mechanisms, and
provides possible early warning to help us control a
worm’s potential damage. The goal of our work is to
propose a mathematical propagation model of
proactive P2P worm and validate it.
The rest of the paper is organized as follows. In
Section 2, we present the mathematical propagation
model of proactive P2P worm. Extensive simulation
studies are carried out in Section 3. We introduce the
related work in Section 4 and conclude in Section 5.
2. Propagation modeling
According to [3], unstructured P2P networks
demonstrate power law distribution, especially the
distribution of node degree. In this paper we use the
GLP power law generator in [4] to generate power law
topologies to represent unstructured P2P networks.
Our major focus in this paper is to understand the
propagation dynamics of proactive P2P worms in
unstructured P2P networks. Thus we define two
security states for P2P hosts: susceptible or infected. A
susceptible host is not protected against the worm. It
gets infected when exposed to the worm attack.
Proactive P2P worms could use hit-list.
Specifically, a worm starts by attacking initial targets
Second International Conference on Genetic and Evolutionary Computing
978-0-7695-3334-6/08 $25.00 © 2008 IEEE
DOI 10.1109/WGEC.2008.75
261