基于超紧估计器的连接失效行为限制自扩散恶意软件
Limiting Self-Propagating Malware Based on Connection Failure Behavior through Hyper-Compact Estimators
摘要：
自传播恶意软件（例如，因特网蠕虫）利用软件中的安全漏洞来感染服务器，然后利用它们来扫描因特网以寻找更易受攻击的服务器。虽然蠕虫感染的机制和传播模型已经很好地理解，但对蠕虫的防御仍然是一个悬而未决的问题。防御研究的一个分支是研究蠕虫感染的宿主和正常宿主之间的行为差异，以将它们区分开来。一个特别的观察是，一个蠕虫感染的主机，它扫描互联网与随机选择的地址，有一个更高的连接失败率比正常主机。人们提出了限速算法，通过基于连接失败率的流量整形来控制蠕虫的传播。然而，这些速率限制算法可以正常工作，只有当它是可能的，以有效和准确地测量故障率的个别主机。本文指出了现有方法中存在的一个严重问题。为了解决这个问题，我们首先提出了一个解决方案的基础上，一个高效的双位图数据结构，它只需要很小的内存占用的路由器，同时提供良好的测量连接失败率，其准确性可以通过系统参数进行调整。在此基础上，提出了基于共享寄存器阵列数据结构的算法，与双位图算法相比，该算法具有更高的存储效率和更大的估计范围。
英文摘要：
Self-propagating malware (e.g., an Internet worm) exploits security loopholes in software to infect servers and then use them to scan the Internet for more vulnerable servers. While the mechanisms of worm infection and their propagation models are well understood, defense against worms remains an open problem. One branch of defense research investigates the behavioral difference between worm-infected hosts and normal hosts to set them apart. One particular observation is that a worm-infected host, which scans the Internet with randomly selected addresses, has a much higher connection-failure rate than a normal host. Rate-limit algorithms have been proposed to control the spread of worms by traffic shaping based on connection failure rate. However, these rate-limit algorithms can work properly only if it is possible to measure failure rates of individual hosts efficiently and accurately. This paper points out a serious problem in the prior method. To address this problem, we first propose a solution based on a highly efficient double-bitmap data structure, which places only a small memory footprint on the routers, while providing good measurement of connection failure rates whose accuracy can be tuned by system parameters. Furthermore, we propose another solution based on shared register array data structure, achieving better memory efficiency and much larger estimation range than our double-bitmap solution.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
