Worm Propagation Scheme Target discovery: the worm in the infected host triesto locate a vulnerable hostCarrier: make victim host to receive worm code, andtransfer worm code to it Activation: change victim host' program counter to?execute worm code. Then the process repeats
Page 6 Worm Propagation Scheme Target discovery: the worm in the infected host tries to locate a vulnerable host Carrier: make victim host to receive worm code, and transfer worm code to it Activation: change victim host’ program counter to execute worm code. Then the process repeats
Signature-based Identifying Worm TechnigueSignature is the fixed length segment (16Bytes)extracted from the binary of worm codeAV software ClamAV use this method, create alarge commonly used signature lib for WormdetectionThere are many other signature generated methodse.g. behavior based detection
Page 7 Signature-based Identifying Worm Technique Signature is the fixed length segment (16Bytes) extracted from the binary of worm code AV software ClamAV use this method, create a large commonly used signature lib for Worm detection There are many other signature generated methods, e.g. behavior based detection
Bloom Filter Technique A Bloom filter is a method for representing a set ofsignatures to support membership queries. It was invented by Burton Bloom in 1970 To add/remove signature, counting Bloom filters ispreferred
Page 8 Bloom Filter Technique A Bloom filter is a method for representing a set of signatures to support membership queries. It was invented by Burton Bloom in 1970. To add/remove signature, counting Bloom filters is preferred
IXP2400's InternalsIXP2400MEv2MEv2DDRAMRbufS32b64@128BPorCMEV2MEv2SGASKE-Intel?TbufPCIXScaleTMX32b64@128BCore64b(64b)32KIC66MHzT32KDCMEv2MEv2Hash64/48/128Scratch16KBCSRSQDRQDR-UARTMEv2-Fast_wrMEV2-GPIO-TimorsSRAMSRAM-BootROM/SlowPortEIDQEIDQBnmos
Page 9 IXP2400’s Internals MEv2 MEv2 MEv2 MEv2 Intel® XScale™ Core 32K IC 32K DC Rbuf 64 @ 128B Tbuf 64 @ 128B Hash 64/48/128 Scratch 16KB QDR SRAM QDR SRAM DDRAM G A S K E T PCI (64b) 66 MHz 32b 32b 64b S P I or C S I X E/D Q E/D Q MEv2 MEv2 MEv2 MEv2 CSRs -Fast_wr -UART -Timers -GPIO -BootROM/Slow Port IXP2400
The Principle -(1)WormcodeinTCP/IPPacketTCPIP headerMACHeaderPayload0000d4c3b2a102000400000000000000000088130000010000000d40323eff7b02000020a2010000a201000000e08121e1660005dd79e870.080045000194312700007410040.53ce9320_8178d1a6aAfsax0060000080 01010100a001010101010010101dcc9b042eb0e010101010101000c0 70ae4201 70ae429090909090 90909068 dcc9b042b8010101 0131c9b1 1850e2fd00e035010101055089e551682e646c6c68656c3332686b65726e51686f756e7468690100636b43684765745466b96c6c516833322e64687773325f66b9657451 68736f63Fig.TCP/IPPacketcarryingSlammerWormcodeRne
Page 10 The Principle –(1) Worm code in TCP/IP Packet MAC Header IP header TCP Payload 0000 d4c3b2a1 02000400 00000000 00000000 88130000 01000000 0d40323e ff7b0200 0020 a2010000 a2010000 00e08121 e1660005 dd79e870 08004500 01943127 00007411 0040 53ce9320 8178d1a6 da240fb0 059a0180 65370401 01010101 01010101 01010101 0060 01010101 01010101 01010101 01010101 01010101 01010101 01010101 01010101 0080 01010101 01010101 01010101 01010101 01010101 01010101 01010101 01010101 00a0 01010101 01010101 01010101 01010101 010101dc c9b042eb 0e010101 01010101 00c0 70ae4201 70ae4290 90909090 90909068 dcc9b042 b8010101 0131c9b1 1850e2fd 00e0 35010101 055089e5 51682e64 6c6c6865 6c333268 6b65726e 51686f75 6e746869 0100 636b4368 47657454 66b96c6c 51683332 2e646877 73325f66 b9657451 68736f63 Fig. TCP/IP Packet carrying Slammer Worm code