Worm Evolution Tracking via Timing Analysis
INTRODUCTION
Worm outbreaks are security events that occur with relatively low frequency, but when they do occur, they can have significant impact on daily network operations. This ever-present threat of severe network disruption has been the motivating factor behind most, if not all, research on practical strategies for worm detection and containment ( see [11, 16, 18, 20, 21] ). There is, however, one desirable aspect of research that falls under the general umbrella of worm mitigation that has received far less attention in the past, namely back-tracking the evolution of a worm outbreak. In fact, thus far there has been little progress in the design and analysis of effective strategies for discovering the sequence with which a worm infected its victims. Even for worms that exhibit uniform scanning behavior, uncovering this sequence is a daunting task, but one that provides invaluable information. For one, doing so has direct pragmatic implications as it allows network operators to pinpoint the initial set of infected machines, thereby gleaning potentially useful forensic evidence.