On the detection and origin identification of mobile worms

Mobility can be exploited to spread malware among wireless nodes moving across network domains. Because such mobile worms spread across domains by exploiting the physical movement of mobile nodes, they cannot be contained by existing defenses. In this paper we address this new challenge using techniques for detecting the existence of stealthy mobile worms in the early stages of their infection and identifying the origins of such infections. The proposed mechanisms are based on random moonwalks which were originally used in post mortem analysis of Internet worms. However as we demonstrate, the original technique fails against mobile worms which are inherently stealthier than existing malware. In this paper, we extend the moonwalk algorithm by considering new heuristics and show that the proposed mechanism can reliably detect mobile worms during the early stages of infection. Our simulation results, based on network traces collected from a university-wide wireless network, show that a mobile infection can be reliably detected before it infects 10% of the vulnerable population. Furthermore, the proposed mechanism identifies the origin of the infection, by limiting the search for the initial victims to within 2% of the mobile node population