1

Email Worm Modeling and Defense

Cliff C. Zou, Don Towsley, Weibo Gong

Univ. Massachusetts, Amherst

2

Internet Worm Introduction

Scan-based worms: Example: Code Red,

Slammer, Blaster, Sasser, … No human interaction

Fast (automatic defense) Need vulnerability

Fewer incidents Network-based blocking

Modeling: no (week) topological issue

Epidemic models

Email worms: Example: Melissa, Love

letter, Sircam, SoBig, MyDoom, …

Human activation Slower

Need no vulnerability More incidents Defense on email

servers Modeling: email address

logical topology No math model yetNimda: mixed

infection

MyDoom: search engine

3

Email Topology — Heavy-tailed Distributed

Email topology degree distr. Size distr. of email address books Popular email list: one list address corresponds to many. Email worms find all addresses on compromised computers.

Email address books, Web cache, text documents, etc.

We study email propagation on power law topologies. Generators available ; best candidate to represent heavy-tailed topology.

1 10 100 1,000 10,000 100,000 1,000,0000.000001

0.00001

0.0001

0.001

0.01

0.1

0

Yahoo GroupRandom graph Complementary cumulative

distribution

(May 2002: > 800,000 Yahoo groups)

4

Email Worm Simulation Model

Discrete time simulation Topology: undirected graph

Power law, small world, random graph

Modeling behavior of individual user Worm email attachment opening prob. Email checking time interval

Following any distribution: Exponential, Erlang, Constant.

Modeling the entire user population normal distr. normal distr.

5

Propagation Stochastic Effect

Power law network: 100,000 nodes, average degree = 8 Nt : the number of infectious at time t. N0 = 2 randomly selected 100 simulation runs for each experiment

Random effect in simulation

Initially infected nodes and initial infection are critical.

It is possible that no one is infected except N0

• When no neighboring nodes open email attachments.

0 50 100 150 200 250 300 350 4000

1

2

3

4

5

6

7

8

9

10x 10

4

Time: t

Nt

MaximumMean valueMinimum

6

Initially infected nodes with different node degree

Initially infected nodes are more important in a sparsely connected network than a densely connected network

0 100 200 300 4000

2

4

6

8

10x 10

4

Time: t

E[Nt]

Highest degreeLowest degree

0 100 200 300 4000

2

4

6

8

10x 10

4

Time: t

E[Nt]

Highest degreeLowest degree

Avg. degree = 8

Avg. degree = 20

7

Effect of email checking time variability

An email worm propagates faster when the email checking time is more stochastically variable.

Snowball effect: Before worm copies give birth to the next generation in the less variable system, worm copies in the more variable system have already given birth to several generations.

0 100 200 300 4000

2

4

6

8

10x 10

4

Time: t

E[Nt]

Exponential distributionErlang distributionConstant value

Random variable Exponential 3rd-order Erlang Constant

8

Topology Effect on Email Worm Propagation

An email worm propagates faster on a power-law topology than on the other two.

Highly connected nodes are infected earlier. They amplify worm propagation speed by shooting out more

copies.

0 100 200 300 4000

2

4

6

8

10x 10

4

Time: t

E[Nt]

Power law topologyRandom graph topologySmall world topology 0 20 40 60 80

0

10

20

30

40

50

Time: t

Dt

Power law topologySmall world topologyRamdom graph topology

Topology effectAvg. degree of infected nodes

(1000 simulation runs)

9

Immunization Defense against Email Worms

Static immunization defense: A fraction of nodes are immune to an email worm before its

outbreak. No nodes will be immunized during the worm’s outbreak.

Selective immunization: Immunizing the mostly connected nodes. Effective for a power-law network

Nodes have very variable node degrees 3 ~ 2000+

10

Selective Immunization Defense

Selective immunization defense is more effective on a power law topology than on the other two. Due to the percolation property of a topology.

0 100 200 300 4000

2

4

6

8

10x 10

4

Time: t

E[Nt]

No immunization5% randomly selected5% most connected

0 50 100 150 200 250 300 350 4000

1

2

3

4

5

6

7

8

9

10x 10

4

Time: t

E[Nt]

No immunization5% randomly selected5% most connected

Power law topology

Small world topology

11

Percolation and Phase Transition

Selective percolation with p: Removing top p percent of mostly connected

nodes. Corresponding to selective immunization.

Newman et al. studied uniform percolation.

Selective percolation property: Connection ratio:

fraction of remained nodes that are connected. Remaining link ratio:

fraction of remained links. Phase transition selective percolation threshold

Disjoint the remaining network when

12

0% 20% 40% 60% 80% 100%0

0.2

0.4

0.6

0.8

1

Selective percolation: p

Connection ratioRemaining link ratio

Why different effect with 5% selective immunization? Power law topology: removing 55.5% links Small world (random graph) topology: removing < 20% links

Email worm prevention via selective immunization (Phase transition) :

30% for the power law topology Around 70% for the small world and random graph topologies.

Power law topology Small world topology

Percolation and Phase Transition

0% 20% 40% 60% 80% 100%0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

Selective percolation: p

Connection ratioRemaining link ratio

13

Summary

Email topology is a heavy-tailed distributed topology.

The impact of a power law topology on email worm propagation is mixed: Cons: an email worm spreads faster than on a

small world or a random graph topology. Pros: static selective immunization defense is

more effective.

14

Future Work

Mathematical modeling Difficulty: considering an arbitrary topology

Directed graph for email topology One-way email address relationship Heavy tailed distr. definition? Topology

generator?

Dynamic immunization defense Short-term focus: Enterprise network

defense