NCJ Number
217925
Journal
Journal of Security Education Volume: 1 Issue: 2/3 Dated: 2005 Pages: 39-53
Date Published
2005
Length
15 pages
Annotation
This paper explains the design and implementation of a simple research Internet worm.
Abstract
The creation of the Simple Proof of Concept (SPOC) worm provides a working worm to experiment within a test environment. This research worm allows the safe examination and exploration of the worm process, including the authoring process. The construction process itself provides valuable insight into the techniques used by malicious authors. A better understanding of worms allows for better defensive techniques to be developed. Another valid and useful approach to worm research is of course to analyze worms that were captured from the Internet. There was an attempt to create a worm that might be experimented with in a laboratory environment. This approach is viewed as a simple, relatively easy to understand authoring process. Security researchers must possess an in-depth understanding of Internet worms in order to effectively combat them. Such an understanding best comes from seeing how a worm is designed and implemented. This paper’s intent is to provide insight into both the methods and mechanisms used in worm creation. The worm described was created in a security research lab at the Georgia Institute of Technology to allow students to witness its spread in a safe, controlled environment. The intent of this paper is to help defend against worm attacks by seeing a research worm from the worm author’s view-point. 6 figures, 12 notes