worm blog

VB2008 call for papers

The Virus Bulletin conference is coming up later this year, but the call for papers closing is only a month and a half away. VB is a nice, fun conference where a lot of top - and rising - AV and malware researchers meet up. There's a growing number of researchers in the field, so getting your research in front of the right people is always a good thing.

I'll skip the long - and interesting - list of topics the conference warmly accepts. About the conference:

Virus Bulletin is seeking submissions from those wishing to present papers at VB2008, which will take place 1-3 October 2008 at the Westin Ottawa, Canada.

To submit a proposal authors should:

• send an abstract of approximately 200 words outlining the proposed paper to editor@virusbtn.com       
• include full contact details with each submission    
• indicate whether the paper is intended for the technical or corporate stream     

Note: deadline for submissions 7 March 2008

Submissions received later than 7 March 2008 will not be considered.

Authors are advised that, should their paper be selected for the conference programme, the deadline for submission of the completed papers will be Monday 9 June 2008, and that they must be available to present their papers in Ottawa between 1 and 3 October 2008.

I don't know if I'll be submitting anything or if I'll be attending, although I would like to. I hope many of you consider submitting research works there, however.

LEET '08 Call for Papers

The First USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET '08) has a CFP that closes soon. From the CFP:

Overview As the Internet has become a universal mechanism for commerce and communication, it has also become an attractive medium for online criminal enterprise. Today, widespread vulnerabilities in both software and user behavior allow miscreants to compromise millions of hosts (worms, viruses, drive-by exploits, etc.), conceal their activities with sophisticated system software (rootkits), and manage these resources via a distributed command and control framework (botnets). This platform in turn provides economics of scale for a wide range of criminal activities including spam, phishing, DDoS, click fraud, and so on.

Topics LEET has evolved from the combination of two other successful workshops, the ACM Workshop on Recurring Malcode (WORM) and the USENIX Workshop on Hot Topics in Understanding Botnets (HotBots), which have each dealt with aspects of this problem. However, while papers relating to both worms and botnets are explicitly solicited, LEET has a broader charter than its predecessors. We encourage submissions of papers that focus on any aspect of the underlying mechanisms used to compromise and control hosts, the large-scale "applications" being perpetrated upon this framework, or the social and economic networks driving these threats.

Source: LEET '08 Call for Papers. Topics for the workshop for readers here include: Infection vectors for malware (worms, viruses, etc.), Boutique and targeted malware, and Reverse engineering.

Important dates:

• Submissions due: February 11, 2008, 11:59 p.m. EST
• Notification of acceptance: March 24, 2008
• Final papers due: April 4, 2008

I don't know if I'll be submitting anything ...

The 5th ACM Workshop on Recurring Malcode (WORM 2007)

Morning, everyone. I know Wormblog has been very, very silent lately as I've been very busy with work. However, I'll wake it up and post a conference call for papers that applies here. I'm on the PC for WORM07, so I should have done this sooner ...

Internet-wide infectious epidemics have emerged as one of the leading threats to information security and service availability. Self-propagating threats, often termed worms, exploit software weaknesses, hardware limitations, Internet topology, and the open Internet communication model to compromise large numbers of networked systems. Malware is increasingly used as a beachhead to launch further malicious activities, such as installing spyware, deploying phishing servers and spam relays, or performing information espionage. Unfortunately, current operational practices still face significant challenges in containing these threats as evidenced by the rise in automated botnet networks and the continued presence of worms released years ago. The goal of this workshop is to provide a forum for exchanging ideas, increasing understanding, and relating experiences on malicious code from a wide range of communities, including academia, industry, and the government.

We are soliciting papers from researchers and practitioners on     subjects including, but not limited to:    

• Automatic malcode detection
• Malicious code characterization
• Botnet detection and disruption
• Malcode reverse engineering
• Modeling and analysis of propagation dynamics
• Forensic methods of attribution
• Threat assessment
• Reactive countermeasures
• Proactive malware defenses
• Significant operational experiences
• Measurement studies
• New threats and related challenges
   

    WORM aims to be a true workshop, with a primary goal of fostering the     development of preliminary work and helping nucleate a malcode     research community. To this end, WORM aims to bring together both     academic researchers and practitioners that fight malware in the     fields. WORM is open to two classes of submissions: research papers and panel proposals.    

                               

17 June, 2007	Paper submission deadline
7 August, 2007	Notification of acceptance
22 August, 2007	Camera-ready papers due
2 November, 2007	Workshop co-located with CCS in Alexandria, VA, USA

The workshop is a one day event and will be held on 2 November, 2007, and is co-located with CCS in Alexandria, VA, USA, at the Hilton Alexandria Mark Center. For more information see the WORM07 website.

HotBots '07 Call for Papers

The call for papers for the First Workshop on Hot Topics in Understanding Botnets (HotBots '07) has been posted on the Usenix website. Topics solicited for short papers include:

• Architecture: Types of botnet topologies, Command&Control, infection vectors, resource sharing across bots and networks, stealthy botnets.
• Detection: Passive or active approaches to detecting participating hosts, C&C communication or botnet activities.
• Measurements: Numbers of botnets and bots, trends over time, geographic distribution, time of life and attrition, identification of parties behind botnet activity.
• Case studies: Experiences with particular botnet cases.
• Mitigation: How to protect against botnets and DDoS, spam, identify theft, etc., originating from them.
• Motivation:  Economic value of botnets, purpose and use of botnets, targeted or special-interest botnets.
• Legal: What forms of mitigation are permissible, what the policy and legal problems in honeynet operation are, interactions with botnet participants, data collection, and traceback.  Policy analysis should be focused toward the practical implementation of botnet monitoring and response systems.

CCS 2006

Just a reminder that early registration deadline for 13th ACM Conference on Computer and Communications Security (CCS 2006) and many of the associated workshops including Workshop on Recurring Malcode (WORM) and Workshop on Visualization for Computer Security (VizSEC) is September 30th. Please see the CCS website for details.

DIMVA 2007 - Call for Papers

It's that time of the year again, time to look at your research and look at publishing it. DIMVA 2007 will be held in Lucerne, Switzerland, July 12-13, 2007.

The annual DIMVA conference serves as a premier forum for advancing the state of the art in intrusion detection, malware detection, and vulnerability assessment. Each year DIMVA brings together international experts from academia, industry and government to present and discuss novel research in these areas. DIMVA is organized by the special interest group Security - Intrusion Detection and Response of the German Informatics Society (GI). The conference proceedings will appear in Springer's Lecture Notes in Computer Science (LNCS) series.

Dates:
February 9, 2007: Deadline for submission of full and short papers.
July 12-13, 2007: DIMVA conference.

You can see full details on the DIMVA 2007 website. For an idea of what they publish, have a look at the DIMVA 2006 program.

WORM06 Program Now Online

The program for WORM06 is now online. Lots of great talks and sessions in this one day event that comes at the end of CCS. WORM06 will be held November 3rd, 2006, at George Mason University, Fairfax, VA, USA. For more information, please see the Workshop on Rapid Malcode (WORM) Workshop Program. If this looks appealing to you, you can register at the CCS2006 website. As I recall, the regstration fee is pretty cheap, around $180 or so.

16th EICAR Annual Conference Call for Papers

While it's early, the EICAR 2007 call for papers has been released. This is a very high profile and well respected conference in the antivirus research community.

The 16th Annual EICAR Conference to be held from 5 May to 8 May 2007 in Radisson SAS Béke Hotel in Budapest, Hungary brings together experts from industry, government, military, law enforcement, academia, research and end-users to examine and discuss new research and development in anti-virus, malware, e-security, e-forensics and Information and Communications Technology (ICT) Management.. This call for papers invites the submission of full papers and abstracts on one or more topics that may include but are not restricted to:

• Malicious code and its side effects
• Viruses and worms
• others remove for brevity

Submission deadlines:
Peer reviewed papers due: 12 January 2007
Other papers (non reviewed): 1 December 2006

Source: 16th EICAR Annual Conference Call for Papers, which will be heldfrom 5 May to 8 May 2007 in Radisson SAS Beke Hotel in Budapest, Hungary.

WORM06: I'll have a panel

Just a quick note to say I'll have a panel at WORM06 this fall. It's entitled "Where the worms aren't" and is going to explore the question "Where are the worms we were lead to believe were going to consume the Internet?" This is, I think, due to a number of factors, including the dramatic rise of bots, the change in the vulnerability landscape, and the reactions of ISPs to the problem of suspicious hosts.

Participants will include Dan Ellis, Nick Weaver, and David Dagon, and the audience. I think this is an important question for a variety of reasons. I hope you can join us or just share your thoughts on this matter in the comments here.

CFP: 2006 Workshop on Rapid Malcode (WORM06)

WORM06 is just around the bend (well, later this year, but the CFP closes next month). I have been remiss in posting this ...

Internet-wide infectious epidemics have emerged as one of the leading threats to information security and service availability. Self-propagating threats, generally termed 'worms', exploit software weaknesses, hardware limitations, Internet topology, and the open Internet communication model to compromise large numbers of networked systems. Internet worms are increasingly being used as delivery mechanisms for malicious payloads such as spyware, phishing servers, spam relays, and information espionage. Unfortunately, current operational practices still face significant challenges in containing these threats as evidenced by the rise in automated botnet networks and the continued presence of worms released years ago.

This workshop provides a forum for exchanging ideas, increasing understanding, and relating experiences on self-propagating malicious software from a wide range of communities, including academia, industry, and the government. We are soliciting papers from researchers and practitioners on subjects including, but not limited to:

• Automatic worm detection and characterization
• Reactive countermeasures
• Proactive defenses
• Detecting and disrupting botnets and malware command and control
• Threat assessment
• New threats and related challenges
• Measurement studies
• Testbeds & evaluation
• Reverse engineering
• Significant operational experiences
• Analysis of worm/botnet construction, current & future
• Modeling and analysis of propagation dynamics
• Forensic methods of attribution

WORM aims to be a true workshop, with a primary goal of fostering the development of preliminary work and helping nucleate a worm-research community.

WORM is also soliciting proposals for a discussion panel on a topic relevant to the workshop. Panel proposals must include the title of the panel, an abstract describing the topic and why it should be of interest to the WORM community, and a list of potential panelists. Panels are expected to be at most 1 hour long, comprised of short presentations by the panelists followed by discussion among panel members and the audience; other formats may be used, but should be described in the proposal.

Papers must be received by 23:59:59 (EDT) of June 16^th, 2006. Reviews of submissions and notification of acceptance or rejection will be sent to the authors no later than August 9^th, 2006, and, for papers to appear in the WORM Proceedings, authors will have an opportunity to revise their work by August 21^st, 2006.

Information site: The 4th Workshop on Recurring Malcode (WORM).
Event details: November 3rd, 2006, held (as always) at George Mason University, Fairfax, VA, USA.

I plan on attending, and if any of you would like to talk to me about getting a panel together with me, that'd be great. Of course, you can submit a panel proposal on your own, too.