Speaker: Dr. Zesheng Chen Florida International University, Miami When: Friday, Oct 26th, 2007 Time: 2:00pm Where: ECS 243 (HPDRC Conf. Room)

Abstract:

As computer and communication networks become prevalent, the Internet has been a battlefield for attackers and defenders. One of the most powerful weapons for attackers is the Internet worm. Specifically, a worm attacks vulnerable computer systems and employs self-propagating methods to flood the Internet rapidly. As a result, worms, such as Code Red, Slammer, and Witty, have infected hundreds of thousands of hosts and become a significant threat to network security and management. The objective of my research is to characterize the spread of worms, analyze Internet vulnerabilities, and develop effective countermeasures. First, a discrete-time mathematical model, called the analytical active worm propagation (AAWP) model, is presented to capture the spreading dynamics of random-scanning worms. The AAWP model provides a tool for characterizing the propagation of worms using different scanning methods and for evaluating the performance of worm detection and defense systems. Second, vulnerable hosts are observed to be highly unevenly distributed in the Internet. A new metric, referred to as the non-uniformity factor, is presented to quantify both the unevenness of a vulnerable-host distribution and the spreading ability of network-aware worms. This metric is essentially the Renyi information entropy. Representative network-aware worms are shown to be able to increase the spreading speed at the early stage with a rate of (nearly) the non-uniformity factor. Finally, the spatial-temporal characteristics of Internet malicious sources are studied by analyzing a large-scale data set from DShield. Internet malicious sources are shown to be clustered, have a short lifetime, and prefer UDP.

Biography:
Dr. Chen is an Assistant Professor in the Department of Electrical and Computer Engineering at Florida International University. He received his MS and PhD degrees from the School of Electrical and Computer Engineering at the Georgia Institute of Technology in 2005 and 2007, respectively. He also holds BE and ME degrees from the Department of Electronic Engineering at Shanghai Jiao Tong University, Shanghai, China in 1998 and 2001. His doctoral dissertation was on Modeling and Defending Against Internet Worm Attacks. His research interests include network security and performance evaluation of computer networks.