Toward a Framework for Forensic Analysis of Scanning Worms

  • Ihab Hamadeh
  • George Kesidis
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3995)


Scanning worms have been around for a while and have had some damaging effects on the Internet. Because of their fast spread and their random selection of their target victims, building a global knowledge about which infected end-systems caused the infection of which susceptible end-systems seems fairly hard. In this paper, we propose to find the originator(s) (i.e., first infected end-system(s)) that spread the worm. The broader view is to build the complete infection tree(s) rooted at the originator(s) and which leaves consist of susceptible machines becoming infected. Besides, scanning worms could unintentionally divulge some information about the machines they infect. We will show how such information could be extracted from the scans of a victim end-system. We studied two different worms, the SQL Slammer/Sapphire worm and the Witty worm, and demonstrated the possibility of building the infection tree and gathering information about the infected end-systems.


Infection Tree Forensic Analysis IPv4 Address Enterprise Network Network Telescope 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Eeye Digital Security: Sapphire Worm Code Disassembled (2003),
  2. 2.
    Hamadeh, I., Kesidis, G.: Performance of IP address fragmentation strategies for DDoS Traceback. In: The Proceedings IEEE Workshop on IP Operations and Management (IPOM) (2003)Google Scholar
  3. 3.
    Kumar, A., Paxson, V., Weaver, N.: Exploiting Underlying Structure for Detailed Reconstruction of an Internet-scale Event. In: The Proceedings of ACM IMC (2005)Google Scholar
  4. 4.
    Lehmer, D.H.: Mathematical methods in large-scale computing units. In: The Proceedings of the 2nd Symposium on Large-Scale Digital Calculating Machinery (1951)Google Scholar
  5. 5.
    Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S., Weaver, N.: The Spread of the Sapphire/Slammer Worm. The Cooperative Association for Internet Data Analysis (2003),
  6. 6.
    Murphy, M.: ISS PAM/ICQ Witty Worm Analysis (2004),
  7. 7.
    University of Michigan Internet Motion Sensor,
  8. 8.
    University of Wisconsin-Madison Advanced Internet Laboratory,
  9. 9.
    Cooperative Association for Internet Data Analysis (CAIDA).UCSD Network Telescope,
  10. 10.
    Savage, S., Wetherall, D., Karlin, A., Anderson, T.: Practical Network Support for IP Traceback. In: The Proceedings ACM SIGCOMM (2000)Google Scholar
  11. 11.
    Shannon, C., Moore, D.: The Spread of the Witty Worm. The Cooperative Association for Internet Data Analysis (2004),
  12. 12.
    Snoeren, A.C., Partridge, C., Sanchez, L.A., Jones, C.E., Tchakountio, F., Kent, S.T., Strayer, W.T.: Hash-Based IP Traceback. In: The Proceedings ACM SIGCOMM (2001)Google Scholar
  13. 13.
    Staniford, S., Paxson, V., Weaver, N.: How to Own the Internet in Your Spare Time (2002)Google Scholar
  14. 14.
    Staniford-Chen, S., Cheung, S., Crawford, R., Dilger, M., Frank, J., Hoagland, J., Levitt, K., Wee, C., Yip, R., Zerkle, D.: GrIDS - A Graph Based Intrustion Detection System for Large Networks. In: The Proceedings of the 19th National Information Systems Security Conference (1996)Google Scholar
  15. 15.
    Staniford, S.: Containment of Scanning Worms in Enterprise Networks. Journal of Computer Security (2004)Google Scholar
  16. 16.
    Weaver, N., Hamadeh, I., Kesidis, G., Paxson, V.: Preliminary results using scale-down to explore worm dynamics. In: The Proceedings of the ACM CCS workshop on Rapid malcode (2004)Google Scholar
  17. 17.
    Whyte, D., Kranakis, E., Van Oorschot, P.C.: DNS-based Detection of Scanning Worms in an Enterprise Network. In: Network and Distributed System Security Symposium (2005)Google Scholar
  18. 18.
    Williamson, M.M.: Throttling Viruses: Restricting Propagation to Defeat Mobile Malicious Code. In: The Proceedings of the 18th (2002)Google Scholar
  19. 19.
    Xie, Y., Sekar, V., Maltz, D., Reiter, M., Zhang, H.: Worm Origin Identification Using Random Moonwalks. In: The Proceedings of the IEEE Symposium on Security and Privacy (2005)Google Scholar
  20. 20.
    Zou, C., Gong, W., Towsley, D.: Worm Propagation Modeling and Analysis under Dynamic Quarantine Defense. In: The Proceedings of the ACM CCS workshop on Rapid malcode (2003)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Ihab Hamadeh
    • 1
  • George Kesidis
    • 1
  1. 1.Department of Computer Science and Engineering, Department of Electrical EngineeringPennsylvania State UniversityUniversity ParkUSA

Personalised recommendations