Detecting intra-enterprise scanning worms based on address resolution

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn 2005, Issue , 2005, Pages 371-380

  Whyte, David ^a   Van Oorschot, Paul C ^a   Kranakis, Evangelos ^a  

^a CARLETON UNIVERSITY   (Canada)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER SOFTWARE; INTERNET; NETWORK PROTOCOLS; SECURITY OF DATA; SOFTWARE PROTOTYPING;

ADDRESS RESOLUTION PROTOCOL (ARP); AUTOMATIC CONTAINMENT; SCANNING WORMS; WORM PROPAGATION;

COMPUTER WORMS;

EID: 33846303234     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CSAC.2005.20     Document Type: Conference Paper

References (23)

1. Forescout. Wormscout. http://www.forescout.com/worm-scout.html.
2. Mirage Networks, http://www.miragenetworks.com.
3. tcpdump/libpcap repository, http://www.tcpdump.org.
4. Silicon Defense. Worm containment in the internal network. Technical report, 2003.
5. R. Droms. Dynamic Host Resolution Protocol. RFC, March 1997. http://www.ietf.org/rfc/rfc2131.txt? number=2131; accessed on January 24, 2005.
6. D. Ellis, J. Aiken, K. Attwood, and S. Tenaglia. A behavioral approach to worm detection. In Proceedings of The Workshop on Rapid Malcode, 2003.
7. Fyodor. Remote OS detection via TCP/IP stack fingerprinting. Phrack, 54, December 1998.
8. G. Ganger, G. Economou, and S. Bielski. Self-securing network interfaces: What, why and how. Technical report, Carnegie Mellon University, CMU-CS-02-144, May 2002.
9. A. Gupta and R. Sekar. An approach for detecting self-propagating email using anomaly detection. In Proceedings of the Sixth International Symposium on Recent Advances in Intrusion Detection, September 2003.
10. J. Jung, V. Paxson, A. Berger, and H. Balakrishman. Fast portscan detection using sequential hypothesis testing. In IEEE Symposium on Security and Privacy, 2004.
11. S. Manwani. ARP cache poisoning prevention and detection. Technical report, Faculty of Computer Science, San Jose State University, December 2003.
12. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Stamford, and N. Weaver. Inside the Slammer Worm. In IEEE Security and Privacy Magazine, pages 33-39, July/August 2003.
13. D. Moore, C. Shannon, G. Voelker, and S. Savage. Internet quarantine: Requirements for containing self-propagating code. In Proc. of the 2003 IEEE Infocom Conference, San Francisco, CA, April 2003.
14. D. Moore, C. Shannon, G. Voelker, and S. Savage. Network Telescopes. Technical report, CAIDA, April 2004.
15. D. Plummer. An Ethernet Address Resolution Protocol. RFC, November 1982. http://www.ietf.org/rfc/rfc0826.txt? number=826; accessed on January 24, 2005.
16. M. Roesch. Snort - lightweight intrusion detection for networks. In LISA, 1999.
17. S. Schechter, J. Jung, and A. W. Berger. Fast Detection of Scanning Worm Infections. In Proceedings of the Seventh International Symposium on Recent Advances in Intrusion Detection, French Riviera, France, September 2004.
18. S. Singh, C. Estan, G. Varghese, and S. Savage. Automated worm fingerprinting. In ACM/USENIX Symposium on Operating System Design and Implementation, Dec. 2004.
19. N. Weaver, V. Paxson, S. Staniford, and R. Cunningham. A taxonomy of computer worms. In The First ACM Workshop on Rapid Malcode, Oct. 2003.
20. N. Weaver, S. Staniford, and V. Paxson. Very fast containment of scanning worms. In Proceedings of the 13th USENIX Security Symposium, 2004.
21. D. Whyte, E. Kranakis, and P. C. van Oorschot. DNS-based detection of scanning worms in an enterprise network. In Proc. of the 12th Annual Network and Distributed System Security Symposium, Feb. 2005.
22. M. Williamson. Throttling viruses: Restricting propagation to defeat malicious mobile code. In Annual Computer Security Applications Conference, 2002.
23. C. Zou, L. Gao, W. Gong, and D. Towsley. Monitoring and early warning for Internet worms. In Proceedings of the 10th ACM CCS, 2003.