• Journal of KIISE:Information Networking
• /
• v.34 no.3
• /
• pp.186-192
• /
• 2007

The virus throttling technique[5,6] is the one of well-known worm early technique. Virus throttling reduce the worm propagration by delaying connection packets artificially. However the worm detection time is not sufficiently fast as expected when the worm generated worm packets at a low rate. This is because the virus throttling technique use only delay queue length. In this paper we use the trend of weighted average delay queue length (TW AQL). By using TW AQL, the worm detection time is not only shorten at a low rate Internet worm, but also the false alarm does not largely increase. By experiment, we also proved our proposed algorithm had better performance.

• The KIPS Transactions:PartC
• /
• v.13C no.5 s.108
• /
• pp.559-566
• /
• 2006

Virus throttling technique, one of many early worm detection techniques, detects the Internet worm propagation by limiting the connect requests within a certain ratio. The typical virus throttling detects worm occurrence by monitoring the length of delay queue with the fixed period of rate limiter. In this paper, we propose an algorithm that controls the period of rate limiter autonomically by utilizing the weighted average delay queue length and suggest various period determination policies that use the weighted average delay queue length as an input parameter. Through deep experiments, it is verified that the proposed technique is able to lessen inconvenience of users by reducing the connection delay time with haying just little effect on worm detection time.

• The KIPS Transactions:PartC
• /
• v.11C no.7 s.96
• /
• pp.993-998
• /
• 2004

As Worm Virus & DDoS attack appeares, the targets and damage of infringement accidents are extending from specific system or services to paralysis of the network itself. These attacks are expending very frequently and strongly, and ISP who will be used as the path of these attacks will face serious damages. But compare to Worm Virus & DDoS attack that generally occures in many Systems at one time with it's fast propagation velocity, network dimensional opposition is slow and disable to deal with the whole appearance for it is operated manually by the network manager. Therefore, this treatise present devices how to detect Worm Virus & DDoS attack's outbreak and the attacker(attacker IP adderss) automatically.

• The KIPS Transactions:PartC
• /
• v.12C no.6 s.102
• /
• pp.847-854
• /
• 2005

Since the propagation speed of the Internet worms is quite fast, worm detection in early propagation stage is very important for reducing the damage. Virus throttling technique, one of many early worm detection techniques, detects the Internet worm propagation by limiting the connection requests within a certain ratio.[6, 7] The typical throttling technique increases the possibility of false detection by treating destination IP addresses independently in their delay queue managements. In addition, it uses a simple decision strategy that determines a worn intrusion if the delay queue is overflown. This paper proposes a two dimensional delay queue management technique in which the sessions with the same destination IP are linked and thus a IP is not stored more than once. The virus throttling technique with the proposed delay queue management can reduce the possibility of false worm detection, compared with the typical throttling since the proposed technique never counts the number of a IP more than once when it chicks the length of delay queue. Moreover, this paper proposes a worm detection algorithm based on weighted average queue length for reducing worm detection time and the number of worm packets, without increasing the length of delay queue. Through deep experiments, it is verified that the proposed technique taking account of the length of past delay queue as well as current delay queue forecasts the worn propagation earlier than the typical iuぉ throttling techniques do.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.32 no.1C
• /
• pp.67-77
• /
• 2007

Virus throttling technique, one of many early worm detection techniques, detects Internet worm propagation by limiting connect requests within a certain ratio. The typical virus throttling controls the period of rate limiter autonomically by utilizing weighted average delay queue length to reduce connection delay time without hanving a large effect on worm detection time. In the existing virus throttling research, a minimum period of variable rate limiter is fired and a turning point which is a point that the period of rate limiter has been being decreased and starts to be increased is also fixed. However, these two performance factors have different effects on worm detection time and connection delay. In this paper, we analyze the effect of minimum period and turning point of variable rate limiter, and then propose an algorithm which determines values of performance factors by referencing current traffic pattern. Through deep experiments, it is verified that the proposed technique is more efficient in respect of reducing worm detection time and connection delay than the existing virus throttling which fixed the performance factors.

• Proceedings of the Korea Society for Simulation Conference
• /
• 2005.11a
• /
• pp.171-179
• /
• 2005

Computer virus modeling and simulation research has been conducted with focus on the network vulnerability analysis. However, computer virus generally shows the biological virus characters such as proliferation, reproduction and evolution. Therefore it is necessary to research the computer virus modeling and simulation using Artificial Life. The approach of computer modeling and simulation using the Artificial Life technology Provides the efficient analysis method for the effects on the network by computer virus and the behavioral mechanism of the computer virus. Hence this paper proposes the methodology of computer virus modeling and simulation using Artificial Life, which may be contribute the research on the computer virus vaccine.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.15 no.6
• /
• pp.37-47
• /
• 2005

Recently, the malicious e-mail worm-viruses have been widely spreaded over the Internet. If the recipient opens the e-mail attachment or an e-mail itself that contains the worm-virus, the worm-virus can be activated and then cause a tremendous damage to the system by propagating itself to everyone on the mailing list in the user's e-mail package. In this paper, we have designed and implemented two methods blocking e-mail worm-viruses. In the fist method, each e-mail is transmitted only by sender activity such as the click of button on a mail client application. In the second one, we insert the two modules into the sender side, where the one module transforms a recipient's address depending on a predefined rule only in time of pushing button and the other converts the address reversely with the former module whenever an e-mail is sent. The lader method also supports a polymorphism model in order to cope with the new types of e-mail worm-virus attacks. The two methods are designed not to work for the e-mail viruses. There is no additional fraction on the receiver's side of the e-mail system. Experimental results show that the proposed methods can screen the e-mail worm-viruses efficiently with a low overhead.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.16 no.3
• /
• pp.53-64
• /
• 2006

Worm analysis report currently produced by anti-virus companies closely resemble those of virus report and do not properly characterize the specific attributes of worms. In this paper, we propose formalized presentation method based on time-based behavioral sequences to more accurately characterize worms. we define a format based on the behavior and communication patterns that occur between an infected host and a target host. we also propose a method for presently worm analysis data with that format. We also compare our framework with analysis data provided by Symantec.

• Journal of the Korea Society for Simulation
• /
• v.15 no.4
• /
• pp.1-10
• /
• 2006

Computer virus modeling and simulation research has conducted with focus on the network vulnerability analysis. But computer virus shows the biological virus characters such as proliferation, reproduction and evolution. Therefore it is necessary to research the computer virus modeling and simulation using the Artificial life technique. The approach of computer modeling and simulation using Artificial life provides the analysis method about the effects on the network by computer virus and the behavior mechanism of computer virus. Hence this paper proposes the methodology of computer virus modeling and simulation using Artificial life, which is effected to contribute the research on the computer virus vaccine.

• Applied Microscopy
• /
• v.21 no.1
• /
• pp.77-85
• /
• 1991

The virus maturation in fat body cells infected with P. rapae granulosis virus were also examined to have the following results. Thin section of P. rapae GV granules showed a regular lattice of the granule enclosing virus particles. Virus particles were observed to penetrate the fat body cells by fusion or viropexis type. The blood and fat body cells uptaked the granulosis viruses a phagosome, in which they were digested by lysosomal enzymes.