论文标题
致力于生成用于蠕虫感染研究的基准数据集
Towards Generating Benchmark Datasets for Worm Infection Studies
论文作者
论文摘要
蠕虫起源识别和传播路径重建是数字取证中的基本问题之一。到目前为止，为此目的提出了几种方法。但是，评估这些方法是一个巨大的挑战，因为没有合适的数据集包含正常背景流量和蠕虫流量来评估这些方法。在本文中，我们研究了生成此类数据集的不同方法，并为此目的提出了一种技术。放松是创建现实模拟环境的工具。但是，它需要一些修改才能适合生成数据集。因此，我们对其进行了必要的修改。然后，我们使用我们的技术在不同的情况下生成了几个针对Slammer，Code Red I，Code Red II和这些蠕虫的修改版本的数据集，并使它们公开可用。
Worm origin identification and propagation path reconstruction are among the essential problems in digital forensics. Until now, several methods have been proposed for this purpose. However, evaluating these methods is a big challenge because there are no suitable datasets containing both normal background traffic and worm traffic to evaluate these methods. In this paper, we investigate different methods of generating such datasets and suggest a technique for this purpose. ReaSE is a tool for the creation of realistic simulation environments. However, it needs some modifications to be suitable for generating the datasets. So we make required modifications to it. Then, we generate several datasets for Slammer, Code Red I, Code Red II and modified versions of these worms in different scenarios using our technique and make them publicly available.
