2007 Proceeding- Program Chair:
- Christopher Kruegel
- Sponsor:
- sigsac
On behalf of the program committee, it is my great pleasure to present the proceedings of the 5th ACM Workshop on Recurring Malcode (WORM). Internet-wide infectious epidemics have emerged as one of the leading threats to information security and service availability. Self-propagating threats, often termed worms, exploit software weaknesses, hardware limitations, Internet topology, and the open Internet communication model to compromise large numbers of networked systems. Malware is increasingly used as a beachhead to launch further malicious activities, such as installing spyware, deploying phishing servers and spam relays, or performing information espionage. Unfortunately, current operational practices still face significant challenges in containing these threats as evidenced by the rise in automated botnet networks and the continued presence of worms released years ago
This year's workshop continues the efforts of the previous years by providing a forum for exchanging ideas, increasing understanding, and relating experiences on malicious code. To this end, we invited participation from a wide range of communities, including researchers and practitioners from academia, industry, and the government. The WORM program committee received 30 paper submissions from all over the world. All submissions were carefully reviewed by at least three members of the program committee and judged on the basis of scientific novelty, importance to the field, and technical quality. The final selection took place at the program committee meeting held in Boston, USA, on August 7th 2007. The program committee selected nine papers based on quality, focus, and the likelihood of stimulating productive discussion at the workshop. Moreover, the program committee also solicited invited talks from leading practitioners to share their perspectives
Proceeding Downloads
A framework for detection and measurement of phishing attacks
Phishing is form of identity theft that combines social engineering techniques and sophisticated attack vectors to harvest financial information from unsuspecting consumers. Often a phisher tries to lure her victim into clicking a URL pointing to a ...
A new worm exploiting IPv4-IPv6 dual-stack networks
It is commonly believed that the IPv6 protocol can provide good protection against network worms due to its huge address space. However, it is proved to be incorrect by our study on the new "dual-stack worm" which can spread in IPv4-IPv6 dual-stack ...
Quorum sensing and self-stopping worms
Random-scanning worms can be adapted, without a complex overlay control network, to stop their scanning activity once a certain percentage of all vulnerable hosts have been infected. This modification makes a worm more difficult to detect for a ...
On the trade-off between speed and resiliency of flashworms and similar malcodes
Inspired by the Flash worm paper [1], we formulate and investigate the problem of finding a fast and resilient propagation topology and propagation schedule for Flash worms and similar malcodes. Resiliency means a very large proportion of infectable ...
Statistical signatures for fast filtering of instruction-substituting metamorphic malware
Introducing program variations via metamorphic transformations is one of the methods used by malware authors in order to help their programs slip past defenses. A method is presented for rapidly deciding whether or not an input program is likely to be a ...
Honey@home: a new approach to large-scale threat monitoring
Honeypots have been shown to be very useful for accurately detecting attacks, including zero-day threats, at a reasonable cost and without false positives. However, there are two pressing problems with existing approaches. The first problem is that ...
Renovo: a hidden code extractor for packed executables
As reverse engineering becomes a prevalent technique to analyze malware, malware writers leverage various anti-reverse engineering techniques to hide their code. One technique commonly used is code packing as packed executables hinder code analysis. ...
On the detection and origin identification of mobile worms
Mobility can be exploited to spread malware among wireless nodes moving across network domains. Because such mobile worms spread across domains by exploiting the physical movement of mobile nodes, they cannot be contained by existing defenses. In this ...
Can you infect me now?: malware propagation in mobile phone networks
In this paper we evaluate the effects of malware propagating usingcommunication services in mobile phone networks. Although self-propagating malware is well understood in the Internet, mobile phone networks have very different characteristics in terms ...
- Proceedings of the 2007 ACM workshop on Recurring malcode