Modeling and detection of camouflaging worms MS Project Dissertation

Project background 

Internet security is the primary research area these days and as the usage of the internet applications is increased drastically the threats caused across the internet are also increased a lot. There are different types of threats to the internet security and the corresponding solutions are given against these threats. Even there are many possible ways to reduce the internet security threats; there is always a scope to introduce the risks in the form of threats to the internet security and in general these threats can be from different sources like virus, Trojan horse and worms. Among these types of attacks, worms have a significant effect on the internet security and there are different types of worms that affect the security of internet.

In general a worm is similar to that of a virus and they replicate themselves and occupy the primary memory and does not affect the system files as a typical virus operation do and they simply reduces the system resources and thus the overall performance of the system is effected a lot. Active worms are heavily detected these days and in general these active worms propagate in to the internet in the form of a malicious software program and effects the other computers that were connected to the internet. There are different types of worms that has affected the internet security in future and few of them include Slammer, Code-Red and Witty and these worms has created a lot of security threats across the internet and following are the important security threats created by these worms 

• Distributed Daniel of service attacks (DDOS) are launched across the internet and the key internet utilities are corrupted
• Confidential information is accessed and the corresponding damage is created to the internet resources
• Distribution of malicious programs in the form of spam emails and messages 

Due to these attacks on the internet, there is lot of work against the worm detection and deletion methods and irrespective of these efforts, always there is a scope of new worm that are emerging on the internet and one among them is Camouflaging worm (C-worm). This type of worm is similar to a traditional worm, where they replicates and affects the system resources and they can affect all the computers connected to the internet at the same time. The actual aim and objectives of this research are as given below 

Aim: To develop a modeling technique to detect the camouflaging worms and evaluates the methodologies to protect the internet security. 

Objectives 

Following are the research objectives 

• To critically review different types of internet security threats and analyze their effect on the internet security
• To analyze different types of internet security threats created by worms and review the various detection systems and their limitations
• To design a modeling and detection system to detect the camouflaging worms using Java as the programming language
• To code the proposed system using Java
• To evaluate the results against the aim of the project and conclude the overall system performance with the implication of the proposed system. 

How these objectives will be achieved 

1. To critically review the types of internet security threats, different sources like online articles, journals, publications and ACM library are referred to gather the required information to do the literature review
2. Literature review holds different aspects like review on internet security, different types of security threats like virus and worms and their corresponding affect on the internet security
3. Different resources as mentioned across point 1, are used to gather the information related to different types of worms and various detection techniques are reviewed and their limitations are also evaluated
4. Design of the proposed system  is done and this design holds the following aspects 

• Front end design of the application
• User interactions to the application
• A module to insert the camouflaging worms to the existing internet applications
• A detection module to detect the worms
• Database design

1. Coding is done using the java programming language and the corresponding database tables are created using SQL database and following aspects are covered under the coding
   1. Front screens coding
   2. Business logic coding
   3. Database coding
   4. camouflaging worms coding
   5. Detection module coding
   6. Results are evaluated against the proposed system and the performance of the detection module is tested.

Implementation procedure 

A java based web application is created that can be used for online education and different roles are created with respect to the application like administrator and student. Following modules are created with respect to this application 

Administrator: Administrator has all the rights on the application like verifying the student details, registering them, registering the teachers, adding the course details and question papers 

Students: Students can login or register to the system and view the course details and write the online examinations. 

Worm module: A separate worm module is created across the application and this  module when initiated, duplicates the files in the database and deletes some important content from the database like the questions papers, course details and also duplicates the number of students such that the administrators when trying to access the student reports gets confused and also the available space across the database is occupied by the duplicate files. 

Detection module: Detection module when initiated by the administrator can detect the affected files from the database and a log file is generated with respect to the worm affected files with the corresponding extensions and thus the administrator can delete them. 

Reasons to choose this project 

In general there are different types of interne security threats faced these days and irrespective of the number of efforts given towards the detection of worms and virus, always there is scope of newly introduced worms every day. I am interested in the internet security area and chosen this topic and will implement a camouflaging worm detection mechanism to ensure the internet security. 

Resources 

Following are the hardware and software requirements for this project 

Hardware Requirements: 

PROCESSOR        :    PENTIUM IV 2.6 GHz

RAM                    : 512 MB 

Software Requirements:

Operating System: Windows XP

 Tools required: JDK 6.0

Database: Oracle 10 G  

Project plan  

Task	Description	Start Date	End Date	Duration
Introduction	Basic introduction to the project along with the problem definition and aims and objectives are defined in this section.			1 week
Literature review	Following topics are covered under literature review  Review on different internet security threats like virus and worm Review on different types of worms and the corresponding detection techniques Review on limitations of the existing detection techniques			4 weeks
Design	Following design aspects are covered under this section   Front end design of the application Database design Modules design			3 weeks
Coding and Implementation	Following aspects are covered under the implementation section  Coding all the modules Establishing the database connections Implementing the modules Explanation to the important coding functions			4 weeks
Evaluation of results	Results achieved after running the individual scenarios and after comparing the scenarios are explained in this chapter with reference to the aims and objectives of this project.			2 weeks
Conclusion and Future work	Conclusion from the total work done and the results evaluation is given and the better ways to improve the project in future are also explained.			1 week

 

 

Deliverables

 

Following are the project deliverables 

Initial report contain the following information 

• Review on different types of virus and worms and their affect on the internet security
• Review on different types of worms and the corresponding detection techniques 

Interim report contain the following information 

• Design of the application covering the front end and database design
• Implementation procedure and explanation to the coding logic followed 

Final report contain the following information 

• Information from both the initial and interim report
• Literature review
• Design
• Coding and implementation procedure
• Evaluation of results
• Conclusion and future work 

Final product contains the following information 

• Rich user interface with an internet application
• Worm detection module
• Database