B.A. Huberman

C.C. Zou

D.J. Daley

G. Pandurangan

N. Litvak

N. Provos

S. Staniford

S.H. Sellke

Z. Chen

Jingyu Hua

Kouichi Sakurai

Crossref

Modeling and Containment of Search Worms Targeting Web Applications

Hua, Jingyu

Sakurai, Kouichi

Eldorado - Ressourcen aus und für Lehre, Studium und Forschung

Modeling and Containment of Search Worms 
Targeting Web Applications
Jingyu Hua*,   Kouichi Sakurai
Information Technolgy & Security Lab
Kyushu Univ.
 2010/7/9  DIMVA’10
Speaker: Jingyu Hua
Email: huajingyu@gmail.com
* He is partly supported by the Grant of Graduate school of ISEE of Kyushu University for
Supporting Students‘ Overseas Traveling and the China Governmental Scholarship.
Outline
 Background: What are Search Worms?
 Motivation: Modeling & Containing
 Modeling of Search Worms
 Containment of Search Worms
 Conclusion
 Future Work
 2010/7/9   DIMVA’10 2/22
Background-Google Hacking
 2010/7/9   DIMVA’10
Google Dorks
Eigenpages: dangerous pages that can disclose server vulnerabilities
Google is a great tool for Hackers!!!
 3/22
Malicious Queries
Sensitive pages
Locate & Exploit Vulnerable Servers
Background-Search Worm
 2010/7/9   DIMVA’10
Infected Server Vulnerable Sever Vulnerable Server
Locate & Exploit Locate & Exploit
Search Worm: a worm uses search engines to locate targets
Example:
Santy:  targeting phpBB bulletin system.
Google Dork: allinurl: viewtopic.php
Released on 12/20/2004, infected 40,000 servers in 2 days
 4/22
Motivation
 Search Worms are dangerous! So, It deservers 
our research.
 Two common problems in the field of worm 
studying:
 How to model the propagation of such worms ?
(I(t) = ?)
 Study the spreading characteristics
 Study the effects of containment strategies
 How to contain the propagation of such worms?
 2010/7/9   DIMVA’10 5/22
Topic 1
Modeling of Search Worms
Modeling of the Search Worms
A virtual search worm
 Vulnerable severs leak eigenpages containing specific keywords 
to search engine.
N: num of severs containing the eigenpages (Suspicious 
severs)
V: num of really exploitable severs (Vulnerable servers)
 Propagation steps of infected severs:
1. Search "special-keywords and random-keywords" in a 
search engine  m search results
2. Choose δ pages among the total m search results to 
scan.
3. Once a server is infected, it begins this infection cycle, 
too.
 2010/7/9   DIMVA’10 6/22
Modeling of the Search Worms
Effects of Eigenpage Distribution
 Obviously, severs contain more eigenpages are 
more likely to be exploited.
 Two attacker-favorable assumptions:
 m search results are randomly selected from all 
the eigenpages on the web
 δ targets are randomly selected from the m
search results
 2010/7/9   DIMVA’10 7/22
Modeling of the Search Worms
Effects of Eigenpage Distribution
 U-Model: eigenpages are uniformly distributed 
on severs
The number of infected servers by the end of 
time tick t:
 2010/7/9   DIMVA’10
The probability that
a specific server is
hit by a scan during
the time tick t
Remained vulnerable
severs by the end of
the time tick t-1
V is the total count of servers really suffering the vulnerabilities
among the N severs containing eigenpages
 8/22
Newly infected 
severs during 
the time tick t
Modeling of the Search Worms
Effects of Eigenpage Distribution
 PL-Model: eigenpages follow a power law 
distribution. 
 2010/7/9   DIMVA’10
The probability that the number
of eigenpages p on a suspicious server is greater than x is
N suspicious 
servers
10 pages 100 pages 10^k pages
Divided into k groups
 9/22
Modeling of the Search Worms
Effects of Eigenpage Distribution
 PL-Model:
 2010/7/9   DIMVA’10
0
10
20
30
40
50
60
70
1 1,5 2 2,5 3 3,5 4 4,5 5
T
im
e 
T
ic
ks
Power Law Exponent σ
0
20000
40000
60000
80000
100000
1 11 21 31 41
N
u
m
b
er
 o
f 
In
fe
ct
ed
 S
er
ve
rs
Time Ticks
σ=2
σ=1.8
σ=1.6
σ=1.4
σ=1.2
 10/22
Time to infect 
95% vulnerable 
severs for the 
PL-Model
Newly infected severs in the i-th group
during the time tick t
U-Model
Modeling of the Search Worms
Effects of Eigenpage Distribution
 Proposition:
Among different distributions of eigenpages, 
the uniform distribution optimizes the 
performance of search worms.
We proved this conclusion by using the mean 
value inequality 
 2010/7/9   DIMVA’10 11/22
Modeling of the Search Worms
Effects of Page Ranking
 Search results are ranked according to Keyword 
relevance, page importance….
 Pages on popular servers are more likely to appear in 
front scan collisions.
 If the second attacker-favorable assumption is true, no 
scan collisions. 
 2010/7/9   DIMVA’10
However, the second assumption is impossible, the propagation of 
search worm will be affected by page ranking
 12/22
Modeling of the Search Worms
Effects of Page Ranking
 Page importance: 
 Page Ranking Value (0-10)
Power Law [Litvak 2007]
 Site importance 
We simply assume servers contain more pages 
are more important
 2010/7/9   DIMVA’10 13/22
[Litvak 2007] Litvak, N., Scheinhardt, W. R. W., Volkovich, Y.: In-degree and PageRank: 
Why do they follow similar power laws? Internet Math, Vol.4(2-3), pp.175-198 (2007)
Modeling of the Search Worms
Effects of Page Ranking
 PR-Model:
An infected server selects the δ top-ranking 
search results to scan
 2010/7/9   DIMVA’10
0
20000
40000
60000
80000
100000
120000
1 11 21 31 41
N
u
m
b
er
 o
f 
In
fe
ct
ed
 S
er
ve
rs
Time Ticks
PR-Model
PL-Model
Page ranking slows down
the spreading of the search
worm
 14/22
Topic 2:
Containment of Search Worms
Containment of the Search Worm
 The goal to model the search worm is to help 
developing an efficient containment system.
 We introduce a conceptual containment system 
based on honey-page insertion.
 We use our propagation models to analyze this 
system.
 2010/7/9   DIMVA’10 15/22
Containment of the Search Worm
 Honey Page
 2010/7/9   DIMVA’10
This is a honey page pointing to a honey pot
 16/22
Containment of the Search Worm
 Containment based on honey-page insertion:
Search engine randomly inserts honey-pages into search results for 
any query.
 2010/7/9   DIMVA’10
Victim
Honey Pot
Exploit
Alert
When the search engine receives an alert, it denies further 
queries form detected victims
 17/22
Containment of the Search Worm
 Is such a strategy possible?
 2010/7/9   DIMVA’10
Honey page insert rate
Probability that an infected sever scans a honey 
page during an infection cycle
0
5000
10000
15000
20000
25000
30000
35000
40000
1 6 11 16 21 26 31 36 41 46
N
u
m
b
er
 o
f 
O
b
se
rv
er
ed
 S
er
ve
rs
Time Ticks
U-Model
μ＝1/100
μ＝1/300
μ＝1/500
An infected sever can be induced to 
scan honeypots in a very short time 
after it is infected even if the insert 
rate is very small.
 18/22
# of detected infected 
nodes by the time t+1
Containment of the Search Worm
 Two questions:
 Containment requirement  Insert Rate?
 Is arbitrary requirement can be reached?
 2010/7/9   DIMVA’10
γ is the final prevalence rate: 
ration of infected vulnerable 
servers
1≤εδ No limitation, arbitrary requirement can be reached
is the density of vulnerable servers.N
V
=ε
 19/22
Containment of the Search Worm
 Effectiveness for the Santy worm
N=6,000,000    V=40,000
To contain the final prevalence rate below 1%
Insert rate  0.011
 2010/7/9   DIMVA’10
2 honey pages in every 100 
search results can stop the 
spreading of the Santy worm 
at its early age!
 20/22
Conclusion
 Modeling of the Search Worm
 Eigenpages Distribution: Uniform distribution 
optimizes the spreading
 Page Ranking: slow downs the spreading
 Containment of the Search Worm
 Honey page insertion
 A small insert rate can lead a good containment 
effect           
 2010/7/9   DIMVA’10 21/22
Challenging Future Work
 Worm may validate the truth of the 
search results. Then, how to disguise 
honey pages as true ones both in URL 
and contents?
 Our current conclusions are based on 
simulation. Real experiments are 
required to verify them.
 2010/7/9   DIMVA’10 22/22
Question & Answer
Thanks for your attention!
 2010/7/9   DIMVA’10


https://eldorado.tu-dortmund.de/bitstream/2003/27359/1/02-05.pdf

Modeling and Containment of Search Worms Targeting Web Applications

Abstract

Similar works

Full text

Available Versions

Crossref

Eldorado - Ressourcen aus und für Lehre, Studium und Forschung