Advanced Search

Browse by Discipline

Scientific Societies

E-print Alerts

Add E-prints

E-print Network

  Advanced Search  

On the Impact of Dynamic Addressing on Malware Propagation

Summary: On the Impact of Dynamic Addressing on Malware
Moheeb Abu Rajab Fabian Monrose Andreas Terzis
Computer Science Department
Johns Hopkins University
While malware models have become increasingly accurate over
the past few years, none of the existing proposals accounts for the
use of Network Address Translation (NAT). This oversight is prob-
lematic since many network customers use NAT in their local net-
works. In fact, measurements we collected from a distributed hon-
eynet show that approximately 19% of the infected hosts reside in
NATted domains. To account for this fact, we present a model that
can be used to understand the impact of varying levels of NAT de-
ployment on malware that spread by preferentially scanning the IP
space. Using this model, we show that NATting impedes malware
propagation in several ways and can have a significant impact on
non-uniform scanning worms as it invalidates the implicit assump-
tion that vulnerable hosts reside in densely populated subnets.


Source: Amir, Yair - Department of Computer Science, Johns Hopkins University


Collections: Computer Technologies and Information Sciences