Worm detection, early warning and response based on local victim information

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn , Issue , 2004, Pages 136-145

  Gu, Guofei ^a   Sharif, Monirul ^a   Qin, Xinzhou ^a   Dagon, David ^a   Riley, George ^b  

^a GEORGIA INSTITUTE OF TECHNOLOGY   (United States)

^b NONE

Author keywords

[No Author keywords available]

Indexed keywords

DESTINATION-SOURCE CORRELATION (DSC); FALSE POSITIVE RATE; SCANNING WORMS; WORM DETECTION;

ALGORITHMS; COMPUTER NETWORKS; CORRELATION METHODS; INTERNET; SECURITY OF DATA; SIMULATORS; USER INTERFACES;

COMPUTER CRIME;

EID: 21644482790     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CSAC.2004.51     Document Type: Conference Paper

References (24)

1. S. Axelsson. The base-rate fallacy and its implications for the difficulty of intrusion detection. In Proceedings of ACM CCS'1999, November 1999.
2. Bittorrent. http://bitconjurer.org/BitTorrent/.
3. B. Bloom. Space/time trade-offs in hash coding with allowable errors. Communications of ACM, 13, July 1970.
4. Z. Chen, L. Gao, and K. Kwiat. Modeling the spread of active worms. In Proceedings of the IEEE INFOCOM 2003, March 2003.
5. D. Dagon, X. Qin, G. Gu, W. Lee, J. Grizzard, J. Levine, and H. Owen. Honeystat: Localworm detection using honeypots. In Proceedings of RAID'2004, September 2004.
6. J. Jung, S. E. Schechter, and A. W. Berger. Fast detection of scanning worm infections. In Proceedings of RAID'2004, September 2004.
7. J. Kephart, D. Chess, and S. White. Computers and epidemiology. 1993.
8. M. Liljenstam, D. Nicol, V. Berk, and R. Gray. Simulating realistic network worm traffic for worm warning system design and testing. In Proceedings of ACM WORM'2003, Oct 2003.
9. D. Moore. Network telescopes. http://www.caida.org/outreach/presentations/2002/usenix_sec/, 2002.
10. D. Moore, C. Shannon, G. M. Voelker, and S. Savage. Internet quarantine: Requirements for containing self-propagating code. In Proceedings of the IEEE INFOCOM 2003, March 2003.
11. N. Proves. A virtual honeypot framework. In Proceedings of 13th USENIX Security Symposium(Security'04), August 2004.
12. X. Qin, D. Dagon, G. Gu, W. Lee, M. Warfield, and P. Allor. Worm detection using local networks. Technical report, College of Computing, Georgia Tech, Feb 2004.
13. G. F. Riley, M. I. Sharif, and W. Lee. Simulating internet worms. In Proceedings of IEEE/ACM MASCOTS'2004, October 2004.
14. S. Staniford, V. Parxon, and N.Weaver. How to Own the Internet in Your Spare Time. In Proceedings of 2002 Usenix Security Symposimum, 2002.
15. S. Staniford-Chen, S. Cheung, and etc. GrIDS-a graph-based intrusion detection system for large networks. In Proceedings of the 19th National Information Systems Security Conference (NISSC'96), October 1996.
16. T. Toth and C. Kruegel. Connection-history based anomaly detection. In Proceedings of the 3rd IEEE Information Assurance Workshop (IASW'02), June 2002.
17. Waikato internet traffic storage. http://wad.cs.waikato.ac.nz/wand/wits/index.html.
18. N. Weaver, S. Staniford, and V. Paxson. Very fast containment of scanning worms. In Proceedings of 13 USENIX Security Symposium (Security'04), October 2004.
19. M. M. Williamson. Throttling viruses: Restricting propagation to defeat malicious mobile code. Technical Report HPL-2002-172, HP Laboratories Bristol, June 2002.
20. J. Wu, S. Vangala, L. Gao, and K. Kwiat. An efficient architecture and algorithm for detecting worms with various scan techniques. In Proceedings of NDSS'2004, February 2004.
21. C. Zou, D. Towsley, W. Gong, and S. Cai. Routing worm: A fast, slective attack worm based on ip address information. Technical Report TR-03-CSE-06, Umass ECE Dept., Novemeber 2004.
22. C. C. Zou, L. Gao, W. Gong, and D. Towsley. Monitoring and early warning for internet worms. In Proceedings of ACM CCS'2003, October 2003.
23. C. C. Zou, W. Gong, and D. Towsley. Code red worm propagation modeling and analysis. In Proceedings of ACM CCS'2002, October 2002.
24. C. C. Zou, W. Gong, and D. Towsley. Worm propagation modeling and analysis under dynamic quarantine defence. In Proceedings of ACM WORM'2003, October 2003.