Entropy based worm and anomaly detection in fast IP networks

Proceedings of the Workshop on Enabling Technologies: Infrastructure for Collaborative Enterprises, WETICE

Volumn 2005, Issue , 2005, Pages 172-177

  Wagner, Arno ^a   Plattner, Bernhard ^a  

^a ETH ZURICH   (Switzerland)

Author keywords

[No Author keywords available]

Indexed keywords

INTERNET PROTOCOL (IP); INTERNET WORMS; TRAFFIC DATA;

COMPUTER WORMS; INTERNET; PUBLIC KEY CRYPTOGRAPHY; REAL TIME SYSTEMS; SECURITY OF DATA; TELECOMMUNICATION TRAFFIC;

NETWORK PROTOCOLS;

EID: 33846200876     PISSN: 15244547     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/WETICE.2005.35     Document Type: Conference Paper

References (20)

1. http://www.oberhumer.com/opensource/lzo/. LZO compression library.
2. The bzip2 and libbzip2 official home page, http://sources.redhat.com/ bzip2/.
3. The gzip home page, http://www.gzip.org/.
4. The swiss education & research network, http://www.switch.ch.
5. Mcafee: W32/nachi.worm. http://vil.nai.com/vil/content/v_100559.htm, August 2003.
6. Symantec Security Response - W32.Blaster.Worm. http://securityresponse. symantec.com/avcenter/venc/data/w32.blaster.worm.html, 2003.
7. W32.welchia.worm. http://securityresponse.symantec.com/avcenter/venc/ data/w32.welchia.worm.html, August 2003.
8. C. C. Z. an L. Gao, W. Gong, and D. Towsley. Monitoring and Early Warning for Internet Worms. In Proceedings of the 10th ACM Conference on Computer and Comminication Security, 2003.
9. CERT. Security Advisory: MS.Blaster (CA-2003-20). http://www.cert.org/ advisories/CA-2003-20.html, 2004.
10. Cisco. White Paper: NetFlow Services and Applications, http://www.cisco.com/warp/public/cc/pd/iosw/ioft/nellct/tech/napps_wp.htm, 2002.
11. DDoSVax. http://www.tik.ee.ethz.ch/~ddosvax/.
12. H. Gabor Szappanos VirusBuster. Virus Bulletin: Virus information and overview - W32/Welchia. http://www.virusbtn.com/resources/viruses/welchia.xml, Apr. 2004.
13. J. Kim, S. Radhakrishnan, and S. K. Dhall. Measurement and Analysis of Worm Propagation on Internet Network Topology. In Proceedings of the International Conference on Computer Communications and Networks, 2004.
14. A. Lakhina, M. Crovella, and C. Diot. Diagnosing network-wide traffic anomalies. In SIGCOMM, pages 219-230, 2004.
15. R. Lemos. MSBlast epidemic far larger than believed, http://news.com.com/ MSBlast+epidemic+far+larger+than+believed/2100-7349_3-5184439.html, 2004.
16. M. Li and P. Vitanyi. An Introduction to Kolmogorov Complexity and Its Applications. Springer Verlag, second edition edition, 1997.
17. O. Müller, D. Graf, A. Oppermann, and H. Weibel. Swiss Internet Analysis. http://www.swiss-internet-analysis.org/, 2004.
18. C. Shannon and D. Moore. CAIDA: The Spread of the Witty Worm, http://www.caida.org/analysis/security/witty/, 2004.
19. K. Theriault, D. Vukelich, W. Fareil, D. Kong, and J. Lowry. Network traffic analysis unsing behaviour-based clustering. Whitepaper, BBN Technologies, http://www.bbn.com/docs/whitepapers/NetTrafficAn-Clustering- Theriault10-02.pdf.
20. US-CERT. Vulnerability Note: Witty (VU#947254). http://www.kb.cert.org/ vuls/id/947254, 2004.