Rapid detection of worms using ICMP-T3 analysis

Proceedings of SPIE - The International Society for Optical Engineering

Volumn 5403, Issue PART 1, 2004, Pages 89-101

  Gray, Robert S ^a   Berk, Vincent H ^a  

^a DARTMOUTH COLLEGE   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

DETECTION MODELS; PROCESS QUERY SYSTEM (PQS); PROPAGATING WORMS; SENSOR FEEDS;

COMPUTATIONAL COMPLEXITY; COMPUTER SYSTEM FIREWALLS; INTERNET; RANDOM PROCESSES; ROUTERS; SCANNING; SENSORS;

COMPUTER WORMS;

EID: 10044250142     PISSN: 0277786X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1117/12.548171     Document Type: Conference Paper

References (16)

1. V. H. Berk, R. S. Gray, and G. Bakos, "Using sensor networks and data fusion for early detection of active worms," in Proceedings of the SPIE Aerosense conference, Orlando Florida, April 2003.
2. M. Liljenstam, D. M. Nicol, V. H. Berk, and R. S. Gray, "Simulating realistic network worm traffc for worm warning system design and testing," in ACM Workshop on Rapid Malcode, Washington DC, October 2003.
3. V. Berk, G. Bakos, and R. Morris, "Designing a framework for active worm detection on global networks," in Proceedings of the IEEE International Workshop on Information Assurance, Darmstadt Germany, March 2003.
4. D. B. Reid, "An algorithm for tracking multiple targets," IEEE Transactions on Automatic Control AC-24, pp. 843-854, December 1979.
5. V. Berk, W. Chung, V. Crespi, G. Cybenko, R. Gray, D. Hernando, G. Jiang, H. Li, and Y. Sheng, "Process query systems for surveillance and awareness," in Proceedings of the Systemics, Cybernetics and Informatics (SCI2003) conference, Orlando Florida, July 2003.
6. C. C. Zou, W. Gong, and D. Towsley, "Worm propagation modeling and analysis under dynamic quarantine defense," in ACM CCS Workshop on Rapid Malcode (WORM 2003), October 2003.
7. D. Moore, C. Shannon, and J. Brown, "Code Red: A case study on the spread and victims of an Internet worm," in Proceedings of the Second Internet Measurement Workshop (IMW 2002), November 2002.
8. D. Moore, V. Paxon, S. Savage, C. Shannon, S. Staniford, and N. Weaver, "The spread of the Sapphire/Slammer worm," technical report, CAIDA, 2003.
9. C. C. Zou, L. Gao, W. Gong, and D. Towsley, "Monitoring and early warning for internet worms," in 10th ACM Conference on Computer and Communication Security (CCS 2003), October 2003.
10. C. C. Zou, D. Towsley, and W. Gong, "On the performance of internet worm scanning strategies," tech. rep., University of Massachusetts, November 2003.
11. X. Qin, D. Dagon, G. Gu, W. Lee, M. Warfield, and P. Allor, "Worm detection using local networks." Submitted to USENIX 2004 and made available on several security mailing lists, 2004.
12. V. Yagneswaran, P. Barford, and J. Ullrich, "Internet intrusions: Global characteristics and prevalance," in Proceedings of the International Conference on Measurements and Modeling of Computer Systems (SIGMETRICS 2003), San Diego California, June 2003.
13. J. Baras, A. Cardenas, and V. Ramezani, "On-line detection of distributed attacks from space-time network flow patterns," in 23rd Army Science Conference, December 2002.
14. D. Moore, G. M. Voelker, and S. Savage, "Inferring Internet Denial-of-Service activity," in Proceedings of the 10th USENIX Security Symposium (USENIX'01), Washington DC, August 2001.
15. D. Daley and J. Gani, Epidemic Modeling, Cambridge University Press, 1999.
16. S. Staniford, V. Paxson, and N. Weaver, "How to Own the Internet in your spare time," in Proceedings of the 11th USENIX Security Symposium (Security '02), August 2002.