On the effectiveness of distributed worm monitoring

14th USENIX Security Symposium

Volumn , Issue , 2005, Pages 225-237

  Rajab, Moheeb Abu ^a   Monrose, Fabian ^a   Terzis, Andreas ^a  

^a JOHNS HOPKINS UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

INTRUSION DETECTION; POPULATION STATISTICS;

DISTRIBUTED MONITORING; INTRUSION DETECTION SYSTEMS; PARTIAL KNOWLEDGE; POPULATION DENSITIES; SCANNING WORMS; SECURITY EVENTS; SYSTEMATIC ANALYSIS; WORM PROPAGATION MODELS;

COMPUTER CRIME;

EID: 31844452004     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (26)

1. Computing Research Association. CRA conference on grand research challenges in Information Security and Assurance, November 2003.
2. Michael Bailey, Evan Cooke, Farnam Jahanian, Jose Nazario, and David Watson. Internet motion sensor: A distributed blackhole monitoring system. In Proceedings of the ISOC Network and Distributed System Security Symposium (NDSS), 2005.
3. Z. Chen, L. Gao, and K. Kwiat. Modeling the Spread of Active Worms. In Proceedings of IEEE INFOCOMM, volume 3, pages 1890 – 1900, 2003.
4. Evan Cooke, Michael Bailey, Z. Morley Mao, David Watson, Farnam Jahanian, and Danny McPherson. Toward Understanding Distributed Blackhole Placement. In Proceedings of ACM Workshop on Rapid Malcode WORM04, pages 54–64, October 2004.
5. Symantec Corporation. W32.Blaster.Worm. Available at: http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html, August 2003.
6. Distributed Intrusion Detection System (DShield). http://www.dshield.org/.
7. “eEye Digital Security”. Code Red-II Worm Analysis. http://www.eeye.com/html/Research/Advisories/ AL20010804.html.
8. “eEye Digital Security”. Code Red Worm. http://www.eeye.com/html/Research/Advisories/AL20010717.html.
9. th Annual Computer Security Applications Conference, December 2004.
10. H.W. Hethcote. The Mathematics of Infectious Diseases. In SIAM Reviews, Vol. 42 No. 4, 2000.
11. Andrew Mackie, Jenssen Roculan, Ryan Russel, and Mario Van Velzen. Nimda Worm Analysis. Available at http://aris.securityfocus.com/alerts/nimda/010919-Analysis-Nimda.pdf, 2001.
12. th USENIX Security Symposium, August 2001.
13. th USENIX Security Symposium, Invited Talk, August 2002.
14. David Moore, Collen Shannon, and Jeffry Brown. Code-Red: A case study on the spread and victims of an Internet worm. In Proceedings of Internet Measurement Workshop, pages 273–284, November 2002.
15. The North America Networks Operators’ Group (NANOG) mailing list. Available at http://www.nanog.org/mailinglist.html.
16. Routeviews- University of Oregon. http://www.routeviews.org/.
17. Colleen Shannon and David Moore. The Spread of the Witty Worm. IEEE Security and Privacy Magazine, 2(4):46–50, July 2004.
18. th USENIX Security Symposium, August 2002.
19. Stuart Staniford, David Moore, Vern Paxson, and Nick Weaver. The Top Speed of Flash Worms. In Proceedings of the ACM Workshop on Rapid Malcode (WORM), pages 33–42, October 2004.
20. The CAIDA Dataset on the Witty Worm - March 19-24, 2004, Colleen Shannon and David Moore, http://www.caida.org/passive/witty/. Support for the Witty Worm dataset and the UCSD Network Telescope are provided by Cisco Systems, Limelight Networks, DHS, NSF, CAIDA, DARPA, Digital Envoy, and CAIDA Members.
21. J. Wu, S. Vanagala, L. Gao L., and K. Kwiat. An Effective Architecture and Algorithm for Detecting Worms with Various Scan Techniques. In Proceedings of the ISOC Network and Distributed System Security Symposium (NDSS), 2004.
22. V. Yegneswaran, P. Barford, and J. Somesh. Global Intrusion Detection in the DOMINO Overlay System. In Proceedings of the ISOC Network and Distributed Systems Security Symposium (NDSS), 2004.
23. C. Zou, L. Gao, W. Gong, and D. Towsley. Monitoring and Early Warning of Internet Worms. In Proceedings of ACM Conference on Computer and Communications Security (CCS), pages 190–199, October 2003.
24. Cliff Zou, D. Towsley, Weibo Gong, and Songlin Cai. Routing Worm: A Fast, Selective Attack Worm based on IP Address Information. UMass ECE Technical Report TR-03-CSE-06, November 2003.
25. C. Zu, W. Gong, and D. Towsley. Code Red Worm Propagation Modeling and Analysis. In Proceedings of ACM Conference on Computer and Communication Security (CCS), pages 138–147, 2002.
26. C. Zu, W. Gong, and D. Towsley. Worm Propagation Modeling and Analysis under Dynamic Quarantine Defense. In Proceedings of the ACM Workshop on Rapid Malcode (WORM), pages 51–60, 2003.