An analysis of BGP updates dynamics during Slammer worm attack

doi:10.21203/rs.3.rs-1394902/v1

Download PDF

Research Article

An analysis of BGP updates dynamics during Slammer worm attack

https://doi.org/10.21203/rs.3.rs-1394902/v1

This work is licensed under a CC BY 4.0 License

Version 1

posted

You are reading this latest preprint version

In present work we investigated the character of dynamical changes in the border gateway protocol (BGP) updates process in Internet during the Slammer worm attack that occurred on 25.01.2003. We analysed BGP updates time series recorded at 8 RIPE RIS collectors located in different parts of world. Time series have been recorded before, during and after Slammer worm attack. Methods of data complex analysis, effective to discern dynamical changes in the considered process, have been used. Lempel and Ziv complexity measure, Local variation, Tsallis entropy, composite multiscale entropy and recurrence quantification analysis have been carried out on BGP updates time series in 24 hour windows shifted by 1 minute step.

In spite of intense interest to the question of stability of Internet, dynamical features of BGP updates process under different harmful influences presently remain not fully understood.

We showed that, the extent of order in the process of BGP updates variability increased during the Slammer worm attack. Such dynamical change lasted about 20 hours and impacted the BGP updates at all considered 8 locations.

It was also shown that changes occurred in the process of BGP updates variation long before and after of worm attack are of different character when compared to period during worm attack. Based on the results of present analysis we conjecture that the observed increase in the regularity of BGP updates is caused by the influence of slammer worm.

Our findings will help in further understanding of dynamics of unwanted influences on Internet processes.

Internet

Slammer worm

border gateway protocol

dynamics

complexity

regularity

Currently, almost no one disputes the fact that the enormous growth of the Internet is accompanied by the emergence of various kinds of threats that can affect its stability and effective functioning.

These threats can be related to diverse, e.g. technical problems (power outage, network misconfiguration), influence of different malicious software (e.g. trojan, worms), etc. https://luminet.co.uk/top-10-common-internet-threats).

Consequently, the prevention of these threats, their timely detection and especially understanding the character of their influences on the critical parts of the Internet, remain a question of immense fundamental and practical importance. Thus, it is understandable that there are different organizations, security companies and research centers aiming at the monitoring of Internet for the detection of abnormal traffic, possibly related to the aforementioned threats. There is a large body of related research works, that were carried out during the last two decades, which focused on the investigation of different aspects of processes taking place in the Internet during regular and abnormal traffic cases.

One of the important subject of these interdisciplinary research efforts, aimed at understanding of processes in the core of the Internet, focused on the analysis of the Border Gateway Protocol (BGP) data sets. [e.g. 1; 2; 3; 4; 5; 6]. The path-vector type Border Gateway Protocol, sometimes is referred to as the glue binding the Internet together. Designed to exchange routing and reachability information among autonomous systems (AS) on the Internet, BGP makes routing decisions based on paths, network policies, or rule-sets configured by a network administrator. BGP failures (caused among others by malicious attacks) could impact diverse modern services relying on the Internet. Thus, it is clear that the further reliable and stable development of the Internet will also dramatically depend on our ability to detect and quantify the character of dynamical changes occurring in the process of BGP updates variation. Especially in the sense of caused by different, internal or external influences transitions from more regular to more randomized behavior and/or vice versa. In this respect we note that, despite a lot of efforts have gone into detecting BGP anomalies during the last decade, it is still a challenging issue due to emerging new abnormal behaviors (caused with attacks, network misconfigurations, etc.)[7].

However, identifying the characteristics of BGP traffic has proven to be a much more difficult task than it seemed. So, Investigation of spiky, highly volatile and unstable process of BGP updates evolution still attracts intense interest of researchers from different fields. [see e.g. 4; 8; 7].

Presently, despite a lot of already applied efforts [see e.g. 1; 2; 3; 4; 5; 6], the enormous size of the Internet with complicated network topology, complexity of interdomain routing and related information flow, results in that many aspects of BGP updates variation still remain unclear. The challenging issue of the analysis of BGP updates variation becomes especially complicated when we intend to assess the influence of anomalies related to different underlying causes. In this context, it is important to note that anomalies may not always be timely reported or sometimes may be even unnoticed by traditional analysis tools [7]. This makes obvious the importance of modern data analysis tools to detect and investigate of the character of changes in the dynamics of BGP updates.

In this work we aimed to analyse dynamical changes in the BGP updates process caused by anomalies connected with the malware Slammer (sometimes called Sapphire) which according to the most trustworthy reports began to attack “slightly before 05:30 UTC on Saturday, 25 January 2003” [9; 10; 7]. As it is reported, Slammer is memory-resident worm which was not designed to infect data, damage system software, or applications resident on desktops and servers. Anyway this, fastest at that time, computer worm, author of which has never been found, within 10 minutes infected 90% of vulnerable hosts and led to a severe denial of service, which resulted in millions of dollars of loss [9; 11].

The very fast spread and damaging impact that Slammer caused financial, transportation, and government institutions, still attract interests of researches to the question of worm related anomaly detection [12; 13; 14; 15]. Though, in spite of availability of good quality BGP updates data sets, recorded in the period of the Slammer attack at different collectors worldwide, research concerning dynamical features of BGP updates process and especially changes caused by worm influence remain very limited even after long time passed since an actual attack.

Thus in this work we aimed to come back to the analysis of BGP updates time series which in general since 2003 are subject of careful analysis though dynamical aspects of BGP updates variation still need further investigation especially using contemporary methods of complex data analysis. For this we analyse dynamical features of BGP updates time series from several collectors in order to find out whether Slammer worm led to quantifiable changes in the BGP updates process.

Researches like presented here are of utmost importance for the understanding of scientific grounds of targeted processes in the core of the Internet as well as the creation of basics for developing practical tools for the BGP network operation community. Indeed presently it is clearly well understandable that without knowledge of underlying dynamical features of unknown process (system) related problems of its short and long range behavior (operation) can not be resolved. Here need to be underlined that in 2014 and 2016 new cases of Slammer worm attack have been reported [16]. To the best of our knowledge, the assessment of the extent of regularity(complexity) in the BGP updates process during the 2003 Slammer worm attack has never been carried out.

In this work, we used BGP updates time series which have been collected from the European network coordination center site (publicly available from https://www.ripe.net), prior and after the attack of the self-propagating Slammer computer worm on 25.01.2003, from 05.30 to 19.30 GMT.

In order to exclude possible influences of any local factors on the general features of the targeted process of BGP updates variation, for the first stage of our analysis, we selected BGP time series from route collectors (rrc) installed at various geographical locations. Namely we selected 8 collectors: rrc03 and rrc00 (Amsterdam), rrc01 (London), rrc04 (Geneva), rrc08(San Jose USA), rrc06 (Otemachi, Japan), rrc05(Vienna), rrc07(Sweden) (some typical examples of used time series see in Fig. 1). These collectors are located in various areas of the world and are sometimes very far away from each other (for example, rrc08 USA, rrc06 Japan) and especially from the remaining selected collectors located in Europe, although two of the latter are located very close (rrc03 and rrc05 Amsterdam).

In addition to the above mentioned time series, we tested also BGP time series recorded in other time periods both before (06.01.2003–09.01.2003 and 12.01.2003–15.01.2003) as well as after (12.02.2003–15.02.2003) slammer worm attack (i.e. 25.01.2003). For these periods, the quality of BGP updates time series was not always good for all mentioned above rrc collectors or have many missed data. Therefore, for this additional analysis, we selected and used time series, of acceptably good quality, from 5 to 6 collectors out of 9 mentioned above.

The selected BGP time series have been normalized by their SD and used for further analysis in sliding windows of 1440 minutes long. These 24 hour windows looked most appropriate for our research task. Indeed, such windows enabled us to avoid separate consideration of known day and night differences in the BGP variation [6] and thus be focused on the analysis of general character of changes related with the Slammer worm influence. The used 1440 minutes long windows were shifted by 1 minute steps.

According to accepted views, identifying and extracting important features from “very noisy, complex, and Voluminous” BGP traffic is challenging task [17; 8]. Important advances towards the solution of this problem may be achieved only based on the modern concepts of complex data analysis.

Thus, since we aimed to assess possible changes in the regularity of BGP updates variation, we used several data analysis methods appropriate for the targeted research. These methods, which are grounded on different basic principles, enabled us to get knowledge about the extent of regularity in considered data sets from different points of view. This itself, helped us to avoid possible errors which might be related to the specificity of a certain method and thus helped us to be more confident in the correctness of the obtained results on dynamical changes in the BGP updates variation process.

We started from the Lempel and Ziv algorithmic complexity (LZC) calculation [18; 19; 20] of selected time series. Being based on the idea of a coarse-graining of measurements LZC uses symbolic techniques to map a time series into a sequence that retains features of original dynamics and starts from the transformation of analyzed data sets into symbolic sequence. LZC is very effective and often used for quantification of the extent of order (or randomness) in the different nonlinear and nondeterministic time series. Usually, original time series is converted into a 0, 1, sequence by comparing to a certain threshold value which usually is the median of the original data set. Once the symbolic sequence is created, it is parsed to obtain distinct words, and the words are encoded. Denoting the length of the encoded sequence for those words, the LZ complexity can be defined as:

$${C}_{LZ}=\frac{L\left(n\right)}{n}$$

where L(n) is the length of the encoded sequence and n is the total length of sequence [20]. Parsing methods can be different [20; 19]. In this work, we used scheme described in Hu&Gao [20]. Lower level of Lempel and Ziv algorithmic complexity indicates increased extent of regularity in considered time series. LZ calculation is popular method used for data sets of different origin including BGP updates time series [19; 21; 6].

Further on, as a regularity metrics we used local variation (Lv) testing method. This is useful method to characterize the extent of randomness in the spiking data [22, 23] and is especially promising for the spiky BGP updates time series [Matcharashvili et al. 2020]. Lv is defined as

$$Lv=\frac{3}{n-1}\sum _{i=1}^{n-1}{\left(\frac{{I}_{i}-{I}_{i+1}}{{I}_{i}+{I}_{i+1}}\right)}^{2}$$

where I_i and I_i+1 are i-th and i + 1th BGP updates accordingly and n is the number of BGPs. According to methods background Lv = 0 when considered time series is perfectly regular and Lv = 1 for random sequences consisted of completely independent events. Further details regarding Lv method can be found in Shinomoto et al., [22, 23].

Another approach which we used is Tsallis entropy calculation. Tsallis entropy calculation is often used method of different complex time series analysis [e.g. 24; 21; 25]. Usually, subsystems of the real world systems are not independent and thus Boltzmann-Gibbs-Shannon condition of extensivity is not satisfied. Consequently, long and short range correlations in such systems are far from to be regarded as negligible at all scales. Thus, we face nonextensive case for which Tsallis [26] introduced special entropic expression:

$${S}_{q}=k\frac{1}{q-1}\left(1-\sum _{i=1}^{W}{p}_{i}^{q}\right)$$

where ${p}_{i}$ are probabilities of existed macroscopic configurations, W is total number of these configurations, k is Boltzmann’s constant, and q, nonextensivity measure is a real number [26]. Quantifying the dynamic changes of the complexity of the system, the Tsallis entropy Sq is lower for the cases which are characterized by lower complexity (are less random).

The next test, we used to quantify the extent of regularity of BGP time series is the Refined composite multiscale entropy (RCMSE) calculation [27]. RCMSE is useful for the multiple scales testing expansion of an estimators of complexity such as sample entropy (SampEn) [28] and multiscale entropy (MSE) [29]. RCMSE is especially useful for a shorter time series, when the variance of the entropy estimator grows very fast as the number of data points is reduced [30].

Besides the above two entropic measures and in order to further quantify changes in dynamics of BGP updates evolution, we used method of the recurrence quantification analysis, which is based on a phase spaсe structures testing of considered process [31; 32; 33]. RQA is useful for different type of data sets and often is efficient to highlight and quantify recurring patterns in time series. In general this is a quantitative extension of Recurrent Plot (RP) construction method and is based on the idea that returning (recurrence) to the certain system condition, or corresponding state space location, is a fundamental property of dynamical system with quantifiable extent of determinism in underlying laws [34]. In order for the RQA calculations to be successfully fulfilled, at first the phase space trajectory should be reconstructed from the given scalar data sets, the proximity of points of the phase trajectory should be tested and marked by the condition that the distance between them is less than a specified threshold [34]. In this way two-dimensional representation of the recurrence features of dynamics embedded in high-dimensional phase space can be obtained. Then a small-scale structure of recurrence plots can be quantified [31; 32; 33; 35]. The RQA technique quantifies visual features in an distance matrix recurrence plot and defines several measures of complexity. Exactly, RQA provides measures of complexity based on the quantification of diagonally and vertically oriented lines in the recurrence plot. In this research we calculated one of such measures (determinism or %DET) which shows changes in the extent of determinism in analyzed data sets, exactly this is the ratio of recurrence points forming diagonal structures to all recurrence points.

At the end of methods section, we underline that in order to exclude errors caused by different random influences, we compared the results obtained for original data sets with those obtained for corresponding randomized data sets.

We observe a significant increase in the number of announcements of BGP updates during Slammer worm attack, which is most evident on a Logarithmic scale in Fig. 1. This significant increase in the number of announcements of BGP was reported many times and it is assumed to be related with the doubling of number of infected machines approximately every 9 seconds [8; 15]. At the same time, it should be noticed that it is still not known who launched Slammer attack and exactly when. It is just supposed that the worm began to infect hosts “slightly before” 05:30 UTC on Saturday, 25 January 2003 [9]. Anyway, we see in Fig. 1, that the actual visual changes in BGP updates time series occurred after 25 January 2003, and these changes on logarithmic scale look very similar for all used BGP updates time series from 8 different locations.

As already mentioned, in the present work we are focused on the analysis of possible dynamical changes caused by Slammer in BGP updates process after worm attack (supposing that, according to accepted view attack started on 25.01.2003, 05.30). At the same time, we briefly will discuss the question of BGP updates behavior in period when obviously slammer worm spreading took place i.e. slightly before 25 January. Separately we will also touch situation with dynamics of BGP updates relatively long before and long after of Slammer attack.

As we see in Figs. 2 and 3, in general, the regularity of the process of BGP updates evolution is of a variable nature and looks different for each rrc location. At the same time, according to the results of the LZC and Lv analysis, we observed qualitatively similar changes in the updates time series at all location following the start of the attack.

These changes show that the extent of regularity of BGP updates variation strongly increased. This increase in the extent of regularity occurred after Slammer worm attack, which began about 05:30 UTC on Saturday, 25 January 2003 and lasted 15–19 hours [9; 10]. Indeed, for this 15–19 hours we observe the strongest decrease in LZC and Lv values for each of analyzed BGP data sets from all selected 8 locations.

As far as we use 1440 data (24h) length sliding windows, shifted by 1 data point (1 minute), it is difficult to discern tiny details in the process of BGP updates evolution. Thus in Figs. 2 and 3 we add insets of shorter observation periods. The presented results confirm that immediately after 05.30 (23.01.2003), the changes in BGP updates process occurred simultaneously in all considered data sets.

These changes, in spite of small quantitative differences, are obviously qualitatively similar and apparently are related with Slammer worm attack (see middle inset in Fig. 2 and inset in Fig. 3). Moreover, we do not see such similarity neither prior nor after Slammer attack (Figs. 2 and 3). On the other hand, we should note some similarity in LZC analysis results of BGP updates variation, what took place for some collectors, in the period when presumably the worm started to spread in the network, i.e. prior to declared Slammer attack (see left inset in Fig. 2).

We also note that the weak decrease in the calculated LZC values that we observed relatively long after Slammer attack (right inset in Fig. 2) involved the time series from only one collector and is seemingly caused by local factors not related to the worm. Meanwhile the results of Lv analysis do not indicate an increase in the extent of regularity besides the period after Slammer worm attack (see Fig. 3).

Thus the results of the LZC and Lv analysis indicate a noticeable increase in the extent of regularity in BGP updates variation that was evident at all 8 considered collectors in the period after Slammer attack. This we regard as a clear indication that the Slammer worm caused similar changes (at least qualitatively) at all considered locations in the period of the attack. The other data analysis methods used for each of 8 considered time series gave the same conclusions (not shown here).

Taking into account the qualitative similarity of changes observed in BGP updates variability from considered collectors, we proceeded to analyzing the BGP time series averaged for all 8 observation sites (see Fig. 4). The analysis of these averaged data sets allowed us to focus on the features of BGP updates variation what are most important and common for all considered collectors that underwent the Slammer worm attack.

The results of the LZC and Lv calculations obtained for averaged BGP updates time series are presented in Figs. 5 and 6. It is clear that after the Slammer worm attack both characteristics essentially decreased, indicating an increase in the extent of regularity in the process of BGP updates variation, like it was shown for the original time series from each location (see Figs. 2 and 3).

The next method we used is Tsallis entropy calculation. Analysis was carried out both for the original as well as averaged BGP updates time series. Following the logic accepted for LZC and Lv calculations, we do not show here results of Tsallis entropy calculation of each original time series and present just results obtained for the averaged time series. Generally, it is known that the results of Sq calculation depend upon the entropic index q. In our case we indeed saw some differences in Sq values obtained for different q indexes though, what is most important for our analysis, Tsallis entropy values for the windows after Slammer worm commencement were always minimal. Thus, for demonstrative purposes, we present results just for q = 0.5, in Fig. 7.

As mentioned, the results indicate a drastic decrease in the value of Sq for the sliding windows located after the start of the Slammer worm attack is declared (25.01.2003). This confirms that the extent of order in the process of BGP updates variability increased after the attack. We note here that in Fig. 7, like in Fig. 5, we see an indication that the extent of order in the averaged data set of BGP updates also increased (though not strongly as after attack) prior to Slammer worm attack (about 19–22 January). At this time, we can not connect this to the influence of worm attack. At the same time, we cannot conclude for sure that this was not caused by the spreading of worm which apparently has started prior 25.01.2003, 05.30 [9].

Such a proposition may be logical assuming that during the worm spreading, changes occurred gradually and did not happen at once at all rrc locations. In any case, for the purpose of present research it is most important that increase of the extent of regularity in BGP updates variation is clearly stronger after the Slammer worm attack and that this is evident for all considered locations.

We next carried out composite multiscale entropy, RCMSE, calculation for averaged BGP data sets. Here we point that, in order to avoid biases related to the variance of estimated entropy values calculated at different scales for different windows, we averaged the calculated values of entropies for all used scales. Such averaging obviously prevents us from having visibility of process on the each of the 10 used scales but is useful for having additional, averaged, entropic measure of complexity in each of windows. The results further confirm the increase in the extent of order in BGP updates process that took place following the Slammer worm attack at all analysed collectors. Indeed, in Fig. 8, we see that, for the averaged BGP updates time series calculated for 1440 min long sliding windows, the values of multiscale entropies are minimal in windows after Slammer worm attack (see the dip below the horizontal dotted line).

We then performed recurrence quantification analysis on the averaged BGP data sets. According to the results of RQA analysis, presented in Fig. 9, it can be concluded that the extent of regularity of the process of BGP updates variation is higher (%DET characteristics increased to maximal value – above grey dotted line) in the windows that followed the start of the Slammer worm attack. Thus, in general, the results of testing of recurrence features in the structure of reconstructed phase space, also confirm the above conclusion about the increased extent of regularity in the process of BGP updates variability following the attack.

Aftermath, we come back to the changes observed prior the start of slammer worm attack. These changes are visible for almost all metrics (see Figs. 4, 5, 7, 8 and 9). Essentially, analyzing both the original and averaged BGP data sets shows that regularity in the update process slightly increased prior to the start of slammer worm attack (please note the changes that occurred between 19 and 22 January 2003). This period of the beginning of worm’s spreading is very interesting because there were little human counter-actions to worm propagation. This period involved both an exponential propagation with constant and positive infection rate [11]. Therefore, the impact on BGP could have been weaker and not observable at all locations. Here we can propose the possibility of preventive countermeasures when in groups of rrc collectors appear simultaneous dynamical changes especially when these changes point to the increase of order in the process of BGP updates evolution. Such preventive countermeasures even for small and hardly detectable changes are of outmost importance because as is thought there are still Internet anomalies that may be ”not reported” or remain “even unnoticed” Karimi et al [7].

In this respect, we recall results of our former analysis of BGP updates data sets from the four largest Internet Service and/or Transit Providers AT&T, NTT, IIJ, and Tinet. On these data sets, recorded in 2011, we showed simultaneous increase in the order of BGP updates variability when no worm or malware attack was reported [6]. In the light of our current results, it can be proposed that mentioned simultaneous increase in BGP variations can be caused by influence of Slammer like worm which may be remained unnoticed that time. Such proposition definitely deserves attention because in 2014 and 2016 a come back of Slammer worm was reported. In the frame of our ongoing research, we investigated the changes in BGP updates that accompanied this recent attack and as a preliminary result we can state that the results seem not to contradict the findings of the present report.

Finally and in an attempt to shed more light on the question of differences in the dynamics of BGP updates variation in periods before during and after the Slammer worm attack, we have carried out additional analysis. Namely as it is described in methods section in addition to BGP time series collected from 16.01.03 to 02.02.03 at 8 main considered collectors we also analysed BGP data sets from other periods from several collectors with acceptably good quality data sets. As said was above we used BGP time series recorded long before slammer worm commencement, from 06.01.2003 to 09.01.2003 and 12.01.2003 to 15.01.2003.

Besides, BGP time series long after slammer worm attack, 12.02.2003 to 15.02.2003 were analysed. For this part of analysis we focused on the LZC and Lv calculations. The results of LZC and Lv analysis for these periods (as well as for the period of main our analysis, from 16.01.03 to 02.02.03) are presented in Figs. 10 and 11. As we see in the two figures, BGP updates variation in periods long before and after the Slammer worm attack also may be characterized by some dynamical changes which for some collectors may even slightly resemble changes caused by Slammer worm attack, described above. At the same time these results provide clear evidence that strong, similar to each other and noticeable for all considered collectors changes in the dynamics of BGP updates evolution occurred only in period of slammer attack (indicated by black frames in Figs. 10 and 11).

Thus we conclude that in the period of Slammer worm attack (approximately 15–16 hours after 25.01.2003) the process of BGP updates variation become much more regular than it was prior or after of computer worm commencement. We note again that this is true for all considered collectors located both close or distant to each other. Such wide spread changes in the dynamics of BGP updates variability, caused by slammer worm attack in the Internet, is quite logical because the propagation of worm codes is usually global and large-scale [11].

We analysed dynamical changes occurred in the process of BGP updates in the period of the Slammer worm attack. This attack took place on 25.01.2003 and lasted 5–19 hours. We used BGP updates time series recorded at 8 rrc collectors. These collectors are located distantly in different parts of the world. Additionally we analysed time series recorded long before and after the attack. We used well known methods of complex data analysis often applied for dynamical analysis of different processes. Namely the Lempel and Ziv complexity measure, Local variation, Tsallis entropy, composite multiscale entropy and recurrence quantification analysis methods have been used. The analysis was carried out on BGP updates time series in 24 hour windows shifted by 1 minute step.

We showed that the extent of order in the process of BGP updates variability increased sharply under the Slammer attack. Such dynamical change lasted at most 20 hours and impacted BGP updates process at all 8 locations.

The observed increase in the regularity of BGP updates process is obvious for all the considered time series. The changes occurred in the process of BGP updates variation long before and after of worm attack are of different character than during the attack.

Funding: The authors declare that no funds, grants, or other support were received during the preparation of this manuscript.

Conflict of Interest: The authors declare that they have no conflict of interest.

The authors have no relevant financial or non-financial interests to disclose.

Author Contributions

Teimuraz Matcharashvili: the study conception and design, data collection and analysis, manuscript draft and final version preparation.

Ahmed Elmokashﬁ: contributed to the study conception, recommendations, manuscript draft preparation.

Natalia Zhukova: programming, data preparation and analysis, technical assistance in final manuscript preparation.

Data Availability

Used BGP data are publicly available from https://www.ripe.net. In case of necessity further information on data and used methods may be available from the corresponding author on reasonable request.

Labovitz, C., Malan, G.R., Jahanian, F.: Internet routing instability. In: Proceedings of the ACM SIGCOMM '97 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication. p. 115, 126. SIGCOMM '97, Association for Computing Machinery, New York, NY, USA: (1997)
Rekhter, Y., Li, T., Hares, S.: A border gateway protocol 4 (BGP-4), RFC 4271., Editor, R.F.C. URL https://tools.ietf.org/html/rfc4271, 2006
Sapegin, A., Uhlig, S.: On the extent of correlation in BGP updates in the Internet and what it tells us about locality of BGP routing events. Comput. Commun. 36, 1592–1605 (2013)
Elmokashfi, A., Dhamdhere, A., Revisiting, B.G.P., Churn Growth: ACM SIGCOMM Computer Communication Review (CCR) 44(1), 5–12 (2014)
Kitsak, M., Elmokashfi, A., Havlin, S., Krioukov, D.: Long-Range Correlations and Memory in the Dynamics of Internet Interdomain Routing. PLOS ONE 10(11), e0141481 (2015)
Matcharashvili, T., Elmokashfi, A., Prangishvili, A.: Analysis of the regularity of the Internet Interdomain Routing dynamics, Phys. A, 124142, https://doi.org/10.1016/j.physa.2020.124142, 2020
Karimi, M., Jahanshahi, A., Mazloumi, A., Sabzi, H.Z., "Border Gateway Protocol Anomaly Detection Using Neural Network,": 2019 IEEE International Conference on Big Data (Big Data), pp. 6092–6094, doi: 10.1109/BigData47090.2019.9006201, 2019
Al-Musawi, B., Branch, P., Armitage, G.: BGP Anomaly Detection Techniques: A Survey. IEEE Commun. Surv. Tutorials 19(1), 377–396 (2017)
Moore, D., Paxson, V., Savage, S.: Inside the slammer worm. IEEE Secur. Priv. 99(4), 33–39 (2003). doi:10.1109/MSECP.2003.1219056
Lad, M., Zhao, X., Zhang, B., Massey, D., Zhang, L.: Analysis of BGP Update Surge during Slammer Worm Attack, pp. 66–79. Springer Berlin Heidelberg, Berlin (2003)
Zou, C.C., Gao, L., Gong, W., Towsley, D., Monitoring and early warning for internet worms, Proceedings of the 10th ACM conference on Computer and communications security, 190–199, 2003, https://doi.org/10.1145/948109.948136
Tharani, A., Leelavathi, B.: Payload based Internet worm detection using network classifier. Int. J. Comput. Sci. Eng. (IJCSE) 6(04), 103–110 (2017)
Iliev, A., Kyerkchiev, N., Ranhev, A., Terzieva, T., Some new approaches for modeling large-scale worm spreading on the Internet. II, Neural, Parallel, and Scientific Computations,27, No. 1, 23–34, (2019)
Asgari, S., Sadeghiyan, B.: Towards Generating Benchmark Datasets for Worm Infection Studies, Journal: 2020 10th International Symposium on Telecommunications (IST),: 2020, ISBN: 9781728180120
Li, Z., Rios, A.L.G., Trajković, L., Detecting Internet Worms, Ransomware, and Blackouts Using Recurrent Neural Networks, pp. 2165–2172, 2020 IEEE International Conference on Systems, Man, and Cybernetics (SMC), 2020, doi: 10.1109/SMC42975.2020.9283472
Chindipha, S.D., Irwin, B., An analysis on the re-emergence of SQL Slammer worm using network telescope data, Southern Africa Telecommunication Networks and Applications Conference (SATNAC), 218–223, 2017
Elmokashfi, A., Kvalbein, A., Dovrolis, C.: BGP churn evolution: a perspective from the core. IEEE/ACM Trans. Networking 20(2), 571–584 (2012) “,”,
Lempel, A., Ziv, J. “On the complexity of finite sequences,” IEEE Trans. Inf. Theory,, vol. IT-22, no. 1, pp. 75–81, Jan. 1976
Aboy, M., Hornero, R., Abásolo, D., Álvarez, D.: ,“Interpretation of the lempel-ziv complexity measure in the context of biomedical signal analysis. IEEE Trans. Biomed. Eng. 53(11), 2282–2288 (2006) ”,
Hu, J., Gao, J., Analysis of Biomedical Signals by the Lempel-Ziv Complexity: the Effect of Finite Data Size, IEEE TRANSACTIONS ON BIOMEDICAL ENGINEERING, VOL. 53, NO. 12, DECEMBER: 2006
Costa, E., Tech, A., Sousa Silva, A.: Linking Non-Extensive Entropy with Lempel-ziv Complexity to Obtain the Entropic Q-index from EEG Signals. In Proceedings of the 10th International Joint Conference on Biomedical Engineering Systems and Technologies (BIOSTEC 2017), pages 101–105, ISBN: 978-989-758-212-7. DOI: 10.5220/0006077901010105
Shinomoto, S., Kim, H., Shimokawa, T., Matsuno, N., Funahashi, S., Shima, K., Fujita, I., Tamura, H., Doi, T., Kawano, K., Inaba, N., Fukushima, K., Kurkin, S., Kurata, K., Taira, M., Tsutsui, K., Komatsu, H., Ogawa, T., Koida, K., Tanji, J., Toyama, K.,Relating neuronal firing patterns to functional differentiation of cerebral cortex. PLoS Comput. Biol. 5(7), 2009. doi:10.1371/journal.pcbi.1000433
Shinomoto, S., Miura, K., Koyama, S.: A measure of local variation of inter-spike intervals. Biosystems. 79(1–3), 67–72 (2005)
Balasis, G., Daglis, I.A., Papadimitriou, C., Anastasiadis, A., Sandberg, I., Eftaxias, K.: Quantifying dynamical complexity of magnetic storms and solar flares via nonextensive Tsallis entropy. Entropy. 13, 1865–1881 (2011a). doi:10.3390/e13101865
Loukidis, A., Triantis, D., Stavrakas, I.: Non-Extensive Statistical Analysis of Acoustic Emissions: The Variability of Entropic Index q during Loading of Brittle Materials Until Fracture. Entropy. 23, 276 (2021). https://doi.org/10.3390/e23030276
Tsallis, C.: Possible generalization of Boltzmann-Gibbs statistics. J. Stat. Phys. 52, 479–487
Wu, S.D., Wu, C.W., Lin, S.G., Lee, K.Y., Peng, C.K., Analysis of complex time series using refined composite multiscale entropy, Physics Letters A 378 (20), 1369–1374, 2014, 1988
Richman, J.S., Moorman, J.R.: Physiological time-series analysis using approximate entropy and sample entropy, American Journal of Physiology-Heart and Circulatory Physiology, vol. 278, no. 6, pp. H2039–H2049, 2000
Costa, M., Goldberger, A.L., Peng, A.L.: Multiscale entropy analysis of biological signals. Phys. Rev. E 71(2), 021906 (2005)
Wu, S.D., Wu, C.W., Lin, S.G., Wang, C.C., Lee, K.Y.: Time Ser. Anal. Using Compos. Multiscale Entropy Entropy 15, 1069–1084 (2013)
Zbilut, J.P., Webber, C.L.: Embeddings and delays as derived from quantification of recurrence plots. Phys. Lett. A 171, 199–203 (1992)
Webber, C.L., Zbilut, J.P.: Dynamical assessment of physiological systems and states using recurrence plot strategies. J. Appl. Physiol. 76, 965–973 (1994)
Marwan, N., Romano, M.C., Thiel, M., Kurths, J.: Recurrence plots for the analysis of complex system. Phys. Rep. 438, 237–329 (2007)
Eckmann, J.P., Kamphorst, S., Ruelle, D.: Recurrence plots of dynamical systems. Europhys. Lett. 4, 973–977 (1987)
Webber, C.L., Marwan, N., Facchini, A., Giuliani, A.: Simpler methods do it better: Success of Recurrence Quantification Analysis as a general purpose data analysis tool. Phys. Lett. A 373, 3753–3756 (2009)

Download PDF

Version 1

posted

You are reading this latest preprint version

An analysis of BGP updates dynamics during Slammer worm attack

Status:

Version 1

Abstract

Figures

Introduction

Used Data And Methods Of Analysis

Results Of Analysis And Discussion

Conclusions

Declarations

References

Status:

Version 1