Search

The article discusses the threat of cyber terrorism and presents suggestions on dealing with it. It refers to some of the many difficulties faced by the international legal community in formulating a response to cyber terrorism including the lack of an agreed definition on acts or conduct to be included in the term cyber terrorism and disagreement across the international community on actions against acts that would amount to terrorism. It mentions instances such as the TV5Monde attack that constitute interference in the domestic affairs of another state and are clearly governed by international law.

Predators, a class of programs that can travel over Internet, and replicate and multiply themselves, are specifically designed to eliminate the computer viruses. To better understand the effects of predators on virus propagation, a model described the coevolution between viruses and predators is proposed. This model has one virus-free equilibrium and two potential viral equilibria. The existence and global stability of these equilibria are fully studied. Furthermore, the optimal solution to control virus propagation is obtained by using Pontryagin's minimum principle. And some numerical experiments are carried out to verify the theoretical results. From the obtained results it can be deduced that predators are quite effective in preventing the widely propagation of viruses with extremely high infection rate. [ABSTRACT FROM AUTHOR]

Because of cost and resource constraints, sensor nodes do not have a complicated hardware architecture or operating system to protect program safety. Hence, the notorious buffer-overflow vulnerability that has caused numerous Internet worm attacks could also be exploited to attack sensor networks. We call the malicious code that exploits a buffer-overflow vulnerability in a sensor program sensor worm . Clearly, sensor worm will be a serious threat when an attacker could simply send a single packet to compromise the entire sensor network. Despite its importance, so far little work has focused on sensor worms. In this work, we first illustrate the feasibility of launching sensor worms through trial experiments on Mica2 motes. Inspired by the survivability through heterogeneity philosophy, we then explore the technique of software diversity to combat sensor worms. Given a limited number of software versions, we design an efficient algorithm to assign the appropriate version of software to each sensor, so that sensor worms are restrained from propagation. We also examine the impact of sensor node deployment errors on worm propagation, which directs the selection of our system parameters based on percolation theory. We then extend the above scheme by considering enhanced sensors that can load multiple program versions. We show that the existence of enhanced sensors could further improve the immunity and robustness of sensor networks under worm attacks. Finally, extensive analytical and simulation results confirm the effectiveness of our schemes in various settings. [ABSTRACT FROM AUTHOR]

The number of malware is increasing rapidly regardless of the common use of anti-malware software. Detection of malware continues to be a challenge as attackers device new techniques to evade from the detection methods. Most of the anti-virus software uses signature based detection which is inefficient in the present scenario due to the rapid increase in the number and variants of malware. The signature is a unique identification for a binary file, which is created by analyzing the binary file using static analysis methods. Dynamic analysis uses the behavior and actions while in execution to identify whether the executable is a malware or not. Both methods have its own advantages and disadvantages. This paper proposes an integrated static and dynamic analysis method to analyses and classify an unknown executable file. The method uses machine learning in which known malware and benign programs are used as training data. The feature vector is selected by analyzing the binary code as well as dynamic behavior. The proposed method utilizes the benefits of both static and dynamic analysis thus the efficiency and the classification result are improved. Our experimental results shows an accuracy of 95.8% using static, 97.1% using dynamic and 98.7% using integrated method. Comparing with the standalone dynamic and static methods, our integrated method gives better accuracy. [ABSTRACT FROM AUTHOR]

In this paper we present a method for detecting malicious Android applications using feature selection methods. Three distinguishing features i.e. opcodes, methods and strings are extracted from each Android file and using feature selection techniques, prominent and diverse, top ranking features are mined. Different tree classifiers are used to categorize Android files as either malware or benign. Results show that methods is the most credible feature, which gives accuracy of 88.75% with 600 attributes using Correlation Feature Selection method and Adaboost with J48 as base classifier. [ABSTRACT FROM AUTHOR]

We present a worm detection system that leverages the reliability of IP-Flow and the effectiveness of learning machines. Typically, a host infected by a scanning or an email worm initiates a significant amount of traffic that does not rely on DNS to translate names into numeric IP addresses. Based on this fact, we capture and classify NetFlow records to extract feature patterns for each PC on the network within a certain period of time. A feature pattern includes: No of DNS requests, no of DNS responses, no of DNS normals, and no of DNS anomalies. Two learning machines are used, K-Nearest Neighbors (KNN) and Naive Bayes (NB), for the purpose of classification. Solid statistical tests, the cross-validation and paired t-test, are conducted to compare the individual performance between the KNN and NB algorithms. We used the classification accuracy, false alarm rates, and training time as metrics of performance to conclude which algorithm is superior to another. The data set used in training and testing the algorithms is created by using 18 real-life worm variants along with a big amount of benign flows. [ABSTRACT FROM AUTHOR]

Blended learning, the combination of traditional face-to-face teaching methods with authentic on-line learning activities, has the potential to transform student learning experiences and outcomes. The blended learning model also allow for more creative and interactive course assignments. One key limitation of the blended learning model is that it is affected by computer worms, power failures and other technology problem. However while implementing blended learning approach in learning mathematics the curriculum should be modified to suit the blended learning approach and the teachers should be trained as online facilitators and that teachers also need to be subject matter experts and reflective learners of their teaching practices. [ABSTRACT FROM AUTHOR]

The article discusses telecommunications law and cyber-espionage during peacetime as of June 2012, focusing on the potential for hackers to breach the U.S. Department of Defense's Non-classified Internet Protocol Router Net (NIPRNet), and it also provides an overview of U.S. and international espionage laws. Besides the U.S., Great Britain and France are also mentioned as possible targets of cyber-espionage. The Stuxnet worm, a dual-purpose computer virus, is also addressed.

The Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030, outlaws conduct that victimizes computer systems. It is a cyber security law. It protects federal computers, bank computers, and computers connected to the Internet. It shields them from trespassing, threats, damage, espionage, and from being corruptly used as instruments of fraud. It is not a comprehensive provision, but instead it fills cracks and gaps in the protection afforded by other federal criminal laws. This is a brief sketch of CFAA and some of its federal statutory companions, including the amendments found in the Identity Theft Enforcement and Restitution Act, P.L. 110-326, 122 Stat. 3560 (2008). In their present form, the seven paragraphs of subsection 1030(a) outlaw * computer trespassing (e.g., hacking) in a government computer, 18 U.S.C. 1030(a)(3); * computer trespassing (e.g., hacking) resulting in exposure to certain governmental, credit, financial, or computer-housed information, 18 U.S.C. 1030(a)(2); * damaging a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce (e.g., a worm, computer virus, Trojan horse, time bomb, a denial of service attack, and other forms of cyber attack, cyber crime, or cyber terrorism), 18 U.S.C. 1030(a)(5); * committing fraud an integral part of which involves unauthorized access to a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce, 18 U.S.C. 1030(a)(4); * threatening to damage a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce, 18 U.S.C. 1030(a)(7); * trafficking in passwords for a government computer, or when the trafficking affects interstate or foreign commerce, 18 U.S.C. 1030(a)(6); and * accessing a computer to commit espionage, 18 U.S.C. 1030(a)(1). Subsection 1030(b) makes it a crime to attempt or conspire to commit any of these offenses. Subsection 1030(c) catalogs the penalties for committing them, penalties that range from imprisonment for not more than a year for simple cyberspace trespassing to a maximum of life imprisonment when death results from intentional computer damage. Subsection 1030(d) preserves the investigative authority of the Secret Service. Subsection 1030(e) supplies common definitions. Subsection 1030(0 disclaims any application to otherwise permissible law enforcement activities. Subsection 1030(g) creates a civil cause of action for victims of these crimes. Subsections 1030(i) and (j) authorize forfeiture of tainted property. [ABSTRACT FROM AUTHOR]

This paper analyzes the concept of survivability and examines some models to ensure the virtual machines survivability. The virtual machines - an isolated duplicates of the real machines, will be analyzed. Some attack models like the Trojan horse and the computer Worm attacks will be proposed to evaluate the performance of virtual machine survivabilit. [ABSTRACT FROM AUTHOR]

Blended learning, the combination of traditional face-to-face teaching methods with authentic on-line learning activities, has the potential to transform student learning experiences and outcomes. The blended learning model also allow for more creative and interactive course assignments. One key limitation of the blended learning model is that it is affected by computer worms, power failures and other technology problem. However while implementing blended learning approach in learning mathematics the curriculum should be modified to suit the blended learning approach and the teachers should be trained as online facilitators and that teachers also need to be subject matter experts and reflective learners of their teaching practices. [ABSTRACT FROM AUTHOR]

The article focuses on the threat that cyber attacks and malicious codes pose against industrial control systems (ICS). It states that the malicious software code Stuxnet can manipulate Windows' vulnerabilities and contaminate its targets with worms which have the capacity to reprogram ICS. It adds that the U.S. Department of Homeland Security (DHS) provides various resources for critical infrastructures which include education and training, informational products and incident awareness.

There is a well-defined propagation model, named the random constant spread (RCS) model, which explains worms that spread their clones with a random scanning strategy. This model uses the number of infected hosts in a domain as a factor in the worms' propagation. However, there are difficulties in explaining the characteristics of new Internet worms because they have several considerable new features: the denial of service by network saturation, the utilization of a faster scanning strategy, a smaller size in the worm's propagation packet, and to cause maximum damage before human-mediated responses are possible. Therefore, more effective factors are required instead of the number of infected hosts. In this paper, the network bandwidth usage rate is found to be an effective factor that explains the propagations of the new Internet worms with the random scanning strategy. The analysis and simulation results are presented using this factor. The simulation results show that the scan rate is more sensitive than the propagation packet for detecting worms' propagations. [ABSTRACT FROM AUTHOR]

The traditional network simulator has function limitation and performance limitation when simulating Internet worm, so we designed the grid based Internet worm behavior simulator (IWBS Grid). IWBS Grid makes use of the real Internet topology information, link information and routing information, and simulates the worm behavior at the packet event-driven level; proposes a high-performance Internet worm behavior simulation platform by right of the grid computing capability, resource and task management, and etc.. The experimental result shows that IWBS grid surpasses the traditional simulator in simulating capability, and the technology to track the worm propagation in packet level can propose the valuable information for the further study on worm. In the mean while, it can promote further study and development on computing grid technology. [ABSTRACT FROM AUTHOR]

As the Conficker (aka Downadup and Kido) worm proved when it first appeared in October 2008, there''s more to a piece of malware code than meets the eye, especially when it is self-updating. But can self-updating also mean self-modifying? Steve Gold investigates whether an IT security manager''s nightmare has become programming reality… [Copyright &y& Elsevier]

This paper serves worm defenders' objective to improve their immunity to future active worms by giving them a deep insight into propagation characteristics of active worms from a worm authors' perspective. Active worms self-propagate across networks by employing scanning, pre-generated target list, or internally generated target lists as their target discovery technique. We find target acquisition and network reconnaissance actions (luring the network propagation phase in a worm's life cycle basically embody its target discovery technique. We derive the significance of target discovery techniques in shaping a worm's propagation characteristics from the life cycles of worms. A variety of target discovery techniques employed by active worms are discussed and compared. We find hitting probability (the probability of hitting a vulnerable or infected host) is the most frequently improved factor by attackers to increase a worm's propagation speed. We anticipate future active worms would employ a combination of target discovery techniques to greatly accelerate their propagation. Various deterministic and stochastic models of active worms are presented and compared. Their accuracy of and applicability to modelling the propagation of active worms under different conditions are discussed. A discussion of opportunities, challenges and solutions from a worm defenders' perspective is presented in this survey paper. We also propose a new defence system called Distributed Active Defence System (DADS) to effectively defend against worms. This new system follows an active surveillance-trace-control cycle, which could be the emerging solution to the active worm problem. [ABSTRACT FROM AUTHOR]

So fast, so cheap, so efficient, Internet is nowadays incontestably communication mean of choice for personal, business and academic purposes. Unfortunately, Internet has not only this beautiful face. Malicious activities enjoy as well this so fast, cheap and efficient mean. The last decade, Internet worms took the lights. In the recent years, spams are invading one of the most used services of Internet: email. This paper summarizes most of techniques used to filter spams by analyzing the email content. [ABSTRACT FROM AUTHOR]

Network attacks have become so fast that human mitigation cannot cope with security requirements. In addition, attackers have become smarter by creating attacks which mutate themselves to prevent detection. Therefore, defense mechanisms must be automated to keep up with attack speed and adapted to seek out mutations. An architecture to support this trend in defense mechanisms is proposed here. The architecture is based upon three conceptual pillars. First is the use of a multi-feedback loop control to slow down an attack. Second, machine learning concepts are employed to properly distinguish between normal and abnormal e-attack traffic. And, third, trust and reputation levels are determined through social networks. A case study on the application of the proposed architecture to a worm propagation attack provides the initial evidence of the e-attack and applicability of the approach. [ABSTRACT FROM AUTHOR]