Effective worm detection for various scan techniques.

Saved in:

Bibliographic Details
Title:	Effective worm detection for various scan techniques.
Authors:	Xia, Jianhong¹ jxia@ecs.umass, Vangala, Sarma¹ svangala@ecs.umass, Wu, Jiang¹ jiawu@ecs.umass, Gao, Lixin¹ lgao@ecs.umass, Kwiat, Kevin² kwiatk@rl.af.mil
Source:	Journal of Computer Security. 2006, Vol. 14 Issue 4, p359-387. 29p. 2 Diagrams, 2 Charts, 10 Graphs.
Subjects:	Computer viruses, Computer virus prevention, Computer software, Data protection, Anomaly detection (Computer security), Algorithm software, Computer network security, Firewalls (Computer security)
Abstract:	In recent years, the threats and damages caused by active worms have become more and more serious. In order to reduce the loss caused by fast-spreading active worms, an effective detection mechanism to quickly detect worms is desired. In this paper, we first explore various scan strategies used by worms on finding vulnerable hosts. We show that targeted worms spread much faster than random scan worms. We then present a generic worm detection architecture to monitor malicious worm activities. We propose and evaluate our detection mechanism called Victim Number Based Algorithm. We show that our detection algorithm is effective and able to detect worm events before 2% of vulnerable hosts are infected for most scenarios. Furthermore, in order to reduce false alarms, we propose an integrated approach using multiple parameters as indicators to detect worm events. The results suggest that our integrated approach can differentiate worm attacks from DDoS attacks and benign scans. [ABSTRACT FROM AUTHOR]
	Copyright of Journal of Computer Security is the property of Sage Publications Inc. and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)
Database:	Engineering Source

Description
Abstract:	In recent years, the threats and damages caused by active worms have become more and more serious. In order to reduce the loss caused by fast-spreading active worms, an effective detection mechanism to quickly detect worms is desired. In this paper, we first explore various scan strategies used by worms on finding vulnerable hosts. We show that targeted worms spread much faster than random scan worms. We then present a generic worm detection architecture to monitor malicious worm activities. We propose and evaluate our detection mechanism called Victim Number Based Algorithm. We show that our detection algorithm is effective and able to detect worm events before 2% of vulnerable hosts are infected for most scenarios. Furthermore, in order to reduce false alarms, we propose an integrated approach using multiple parameters as indicators to detect worm events. The results suggest that our integrated approach can differentiate worm attacks from DDoS attacks and benign scans. [ABSTRACT FROM AUTHOR]
ISSN:	0926227X
DOI:	10.3233/JCS-2006-14403