tailieunhanh - Exploiting Underlying Structure for Detailed Reconstruction of an Internet-scale Event

In this paper, we propose a framework for unusual event detection. Our approach is motivated by the observation that, while it is unrealistic to obtain a large training data set for unusual events, it is conversely possible to do so for usual events, allowing the creation of a well-estimated model of usual events. In order to overcome the scarcity of training material for unusual events, we propose the use of Bayesian adaptation techniques [14], which adapt a usual event model to produce a number of unusual event models in an unsupervised manner. The proposed framework can thus be considered as a semi-supervised learning technique. In our framework, a new unusual event. | Exploiting Underlying Structure for Detailed Reconstruction of an Internet-scale Event Abhishek Kumar Georgia Institute of Technology akumar@ Vern Paxson ICSI vern@ Nicholas Weaver ICSI nweaver@ Abstract Network telescopes that record packets sent to unused blocks of Internet address space have emerged as an important tool for observing Internet-scale events such as the spread of worms and the backscatter from flooding attacks that use spoofed source addresses. Current telescope analyses produce detailed tabulations of packet rates victim population and evolution over time. While such cataloging is a crucial first step in studying the telescope observations incorporating an understanding of the underlying processes generating the observations allows us to construct detailed inferences about the broader universe in which the Internetscale activity occurs greatly enriching and deepening the analysis in the process. In this work we apply such an analysis to the propagation of the Witty worm a malicious and well-engineered worm that when released in March 2004 infected more than 12 000 hosts worldwide in 75 minutes. We show that by carefully exploiting the structure of the worm especially its pseudo-random number generation from limited and imperfect telescope data we can with high fidelity extract the individual rate at which each infectee injected packets into the network prior to loss correct distortions in the telescope data due to the worm s volume overwhelming the monitor reveal the worm s inability to fully reach all of its potential victims determine the number of disks attached to each infected machine compute when each infectee was last booted to sub-second accuracy explore the who infected whom infection tree uncover that the worm specifically targeted hosts at a US military base and pinpoint Patient Zero the initial point of infection . the IP address of the system the attacker used to unleash Witty. 1 Introduction .