Efficient content-based detection of zero-day worms

IEEE International Conference on Communications

Volumn 2, Issue , 2005, Pages 837-843

  Akritidis, P ^a   Anagnostakis, K ^b   Markatos, E P ^a  

^a INSTITUTE OF COMPUTER SCIENCE   (Greece)

^b UNIVERSITY OF PENNSYLVANIA   (United States)

Author keywords

Internet worm detection; Network level intrusion detection; Security

Indexed keywords

AUTOMATION; COMPUTER WORMS; INTERNET; TELECOMMUNICATION TRAFFIC;

CYBERSECURITY; HOSTS; HUMAN-MEDIATED REACTIONS; PACKET CONTENTS;

SECURITY OF DATA;

EID: 24344477123     PISSN: 05361486     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (17)

1. C. Shannon and D. Moore, "The spread of the witty worm," 2004, http://www.caida.org/analysis/security/witty/.
2. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver, "The spread of the sapphire/slammer worm," CAIDA, ICSI, Silicon Defense, UC Berkeley EECS and UC San Diego CSE, Tech. Rep., 2003.
3. S. Staniford, V. Paxson, and N. Weaver, "How to Own the internet in your spare time," in Proceedings of the 11th USENIX Security Symposium (Security '02), 2002.
4. S. Staniford, D. Moore, V. Paxson, and N. Weaver, "The top speed of flash worms," in WORM'04: Proceedings of the 2004 ACM workshop on Rapid malcode. ACM Press, 2004, pp. 33-42.
5. N. T. Spring and D. Wetherall, "A protocol-independent technique for eliminating redundant network traffic," in Proceedings of the conference on Applications, Technologies, Architectures, and Protocols for Computer Communication. ACM Press, 2000, pp. 87-95.
6. M. Rabin, "Fingerprinting by random polynomials," Center for Research in Computing Technology - Harvard University, Tech. Rep. 15-81, 1981.
7. M. Roesch, "Snort: Lightweight intrusion detection for networks," in Proceedings of USENIX LISA'99, November 1999, (software available from http://www.snort.org/).
8. U. Manber, "Finding similar files in a large file system," in Proceedings of the USENIX Winter 1994 Technical Conference, San Fransisco, CA, USA, Jan. 1994, pp. 1-10.
9. D. Moore, C. Shannon, G. M. Voelker, and S. Savage, "Internet quarantine: Requirements for containing self-propagating code," in INFOCOM, 2003.
10. S. Singh, C. Estan, G. Varghese, and S. Savage, "Automated worm fingerprinting," in Proceedings of the ACM/USENIX Symposium on Operating System Design and Implementation, Dec. 2004.
11. C. Estan and G. Varghese, "New directions in traffic measurement and accounting," in Proceedings of the 2001 ACM SIGCOMM Internet Measurement Workshop, 2001, pp. 75-80.
12. G. Bakos and V. Berk, "Early detection of internet worm activity by metering icmp destination unreachable messages," in Proceedings of the SPIE Aerosense 2002, 2002.
13. N. Weaver, S. Staniford, and V. Paxson, "Very fast containment of scanning worms." in USENIX Security Symposium, 2004, pp. 29-44.
14. R. Janakiraman, M. Waldvogel, and Q. Zhang, "Indra: A peer-to-peer approach to network intrusion detection and prevention," in Proceedings of IEEE WETICE 2003, June 2003.
15. C. Kreibich and J. Crowcroft, "Honeycomb - creating intrusion detection signatures using honeypots," in Proceedings of the Second Workshop on Hot Topics in Networks (HotNets-II). Cambridge, Massachusetts: ACM SIGCOMM, Nov. 2003.
16. V. Yegneswaran, P. Barford, and S. Jha, "Global intrusion detection in the DOMINO overlay system," in Proceedings of the 11th Annual Network and Distributed System Security Symposium, San Diego, CA, Feb. 2004.
17. H.-A. Kim and B. Karp, "Autograph: Toward automated, distributed worm signature detection," in Proceedings of the 13th Usenix Security Symposium, 2004.