A framework for real-time worm attack detection and backbone monitoring

Proceedings - First IEEE International Workshop on Critical Infrastructure Protection, IWCIP 2005

Volumn 2005, Issue , 2005, Pages 10-19

  Dübendorfer, Thomas ^a   Wagner, Arno ^a   Plattner, Bernhard ^a  

^a ETH ZURICH   (Switzerland)

Author keywords

Anomaly detection; Backbone; Blaster; Framework; Host behaviour; Nachi; NetFlow; Online analysis; Plug in; UPFrame; Witty; Worm outbreak

Indexed keywords

COMPUTER WORMS; INTERNET; ONLINE SYSTEMS; REAL TIME SYSTEMS; TELECOMMUNICATION TRAFFIC;

ANOMALY DETECTION; FRAMEWORK; HOST BEHAVIOR; ONLINE ANALYSIS; UPFRAME; WORM OUTBREAK;

SECURITY OF DATA;

EID: 33846524304     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/IWCIP.2005.2     Document Type: Conference Paper

References (26)

1. The Swiss Education & Research Network, http://www.switch.ch/.
2. McAfee: W32/Nachi.worm. http://vil.nai.com/vil/content/v_100559.htm, August 2003.
3. W32.Welchia.Worm. http: //securityresponse.Symantec.com/avcenter/venc/ data/w32.welchia.worm.html, August 2003.
4. GNUGPL. http://www.gnu.org/licenses/gpl.html, Jan. 2005.
5. ntop - a network traffic probe, http://www.ntop.org/, June 2005.
6. CAIDA. cflowd tools. http://www.caida.org/tools/measurement/cf lowd/, 1998.
7. CERT/CC. Statistics 1988-2003. http://www.cert.org/stats/cert_stats.html.
8. Cisco. White Paper: NetFlow Services and Applications.http://www.cisco. com/warp/public/cc/pd/iosw/ioft/neflct/tech/napps_wp.htm, 2002.
9. T. Dübendorfer and B. Plattner. Host Behaviour Based Early Detection of Worm Outbreaks in Internet Backbones. In Pro-ceedings of 14th IEEE WETICE/STCA security workshop. IEEE, June 2005.
10. P. Ferguson and G. Huston. Quality of Service: Delivering QoS on the Internet and in Corporate Networks, http:// en.wikipedia.org/wiki/Leaky_bucket, 1998.
11. M. Fullmer. flow-tools, http://www.splintered. net/sw/flow-tools/, Mar. 2003.
12. H. Gabor Szappanos VirusBuster. Virus Bulletin:Virus information and overview - W32/Welchia.http://www.virusbtn.com/resources/viruses/welchia.xml, Apr. 2004.
13. ISS. Internet Security Systems, http://www.iss. net/, 2004.
14. R. Lemos. MSBlast epidemic far larger than believed. http://news.com.com/ MSBlast+epidemic+ far+larger+than+believed/2100-7349_ 3-5184439.html, 2004.
15. Lukas Haemmerle. Master's Thesis: P2P Filesharing Population Tracking, ftp://www.tik.ee.ethz.ch/pub/ students/2004-So/MA-2004-04.pdf,2005.
16. O. Müller, D. Graf, A. Oppermann, and H. Weibel. Swiss Internet Analysis. http://www. swiss- internet-analysis.org/, 2004.
17. D. Plonka. Flowscan. http://www.caida.org/tools/utilities/flowscan/, Oct. 2003.
18. C. Schlegel. Diploma thesis: Realtime UDP NetFlow Processing Framework, ftp://www.tik.ee.ethz. ch/pub/students/2 003 -So/DA-2003-26.pdf, September 2003.
19. C. Schlegel and T. Dübendorfer. UPFrame - A generic open source UDP processing framework, http://www.tik.ee.ethz.ch/~ddosvax/upframe/, January 2005.
20. C. Shannon and D. Moore. CAIDA: The Spread of the Witty Worm, http://www.caida.org/analysis/security/witty/, March 2004.
21. Symantec Security Response. W32.Blaster.Worm.http://securityresponse. Symantec.com/avcenter/venc/data/w3 2.blaster.worm, ht ml, 2003.
22. Symantec Security Response. W32.Sasser.Worm.http://securityresponse. Symantec.com/avcenter/venc/data/w32.sasser.worm.html,April 2004.
23. Tobi Oetiker. RRDTool - A round robin database tool for logging and graphing time-series data, http://people.ee.ethz.ch/~oetiker/webtools/rrdtool/.
24. US-CERT. Vulnerability Note: Witty (VU#947254). http: //www.kb.cert.org/vuls/id/947254, 2004.
25. A. Wagner, T. Dübendorfer, and B. Plattner. The DDoSVax project at ETH Zürich, http://www.tik.ee.ethz. ch/~ddosvax/,2005.
26. A. Wagner and B. Plattner. Entropy Based Worm and Anomaly Detection in Fast IP Networks. In Proceedings of 14th IEEE WETICE/STCA security workshop. IEEE, June 2005.