Fast detection of scanning worm infections

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 3224, Issue , 2004, Pages 59-81

  Schechter, Stuart E ^a   Jung, Jaeyeon ^b   Berger, Arthur W ^b  

^a HARVARD UNIVERSITY   (United States)

^b MASSACHUSETTS INSTITUTE OF TECHNOLOGY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

SCANNING;

CONNECTION RATES; FALSE ALARM RATE; FAST DETECTIONS; HYBRID APPROACH; RESPONSE SYSTEMS; SCANNING WORMS; SEQUENTIAL HYPOTHESIS TESTING; WORM DETECTION;

INTRUSION DETECTION;

EID: 35048831757     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-30143-1_4     Document Type: Article

References (27)

1. George Bakos and Vincent Berk. Early detection of internet worm activity by metering ICMP destination unreachable messages. In Proceedings of the SPIE Aerosense, 2002.
2. Vincent Berk, George Bakos, and Robert Morris. Designing a framework for active worm detection on global networks. In Proceedings of the IEEE International Workshop on Information Assurance, March 2003.
3. Vincent H. Berk, Robert S. Gray, and George Bakos. Using sensor networks and data fusion for early detection of active worms. In Proceedings of the SPIE Aerosense Conference, April 2003.
4. CERT. "Code Red II:" another worm exploiting buffer overflow in HS indexing service DLL. http://tinyurl.com/21zgb.
5. F-Secure. Computer virus information pages: Lovsan. http://tinyurl.com/ ojdl.
6. F-Secure. Computer virus information pages: Mimail.J. http://tinyurl.com/3ybsp.
7. Jaeyeon Jung, Vern Paxson, Arthur W. Berger, and Hari Balakrishnan. Fast portscan detection using sequential hypothesis testing. In Proceedings of the IEEE Symposium on Security and Privacy, May 9-12, 2004.
8. Darrell M. Kienzle and Matthew C. Elder. Recent worms: a survey and trends. In Proceedings of the 2003 ACM Workshop on Rapid Malcode, pages 1-10. ACM Press, October 27, 2003.
9. David Moore, Vern Paxson, Stefan Savage, Colleen Shannon, Stuart Staniford, and Nicholas Weaver. Inside the Slammer worm. IEEE Security and Privacy, 1:33-39, July 2003.
10. David Moore, Colleen Shannon, Geoffrey M. Voelker, and Stefan Savage. Internet quarantine: Requirements for containing self-propagating code. In Proceedings of IEEE INFOCOM, April 1-3, 2003.
11. Network Associates Inc. Security threat report for W32/MydoomMM. http://tinyurl.com/2asgc.
12. Vern Paxson. Bro: A system for detecting network intruders in real-time. http://www.icir.org/vern/bro-info.html.
13. Vern Paxson. Bro: a system for detecting network intruders in real-time. Computer Networks, 31(23-24):2435-2463, 1999.
14. Stelios Sidiroglou and Angelos D. Keromytis. Countering network worms through automatic patch generation. Technical Report CUCS-029-03, 2003.
15. Stelios Sidiroglou and Angelos D. Keromytis. A network worm vaccine architecture. In Proceedings of the IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE), Workshop on Enterprise Security, June 2003.
16. Stuart Staniford. Containment of scanning worms in enterprise networks. Journal of Computer Security, Forthcoming.
17. Stuart Staniford, James Hoagland, and Joseph McAlerney. Practical automated detection of stealthy portscans. Journal of Computer Security, 10(1):105-136, 2002.
18. Stuart Staniford, Vern Paxson, and Nicholas Weaver. How to Own the Internet in your spare time. In Proceedings of the 11th USENIX Security Symposium, August 7-9, 2002.
19. S. Staniford-Chen, S. Cheung, R. Crawford, M. Dilger, J. Frank, J. Hoagland, K. Levitt, C. Wee, R. Yip, and D. Zerkle. GrIDS - A graph-based intrusion detection system for large networks. In Proceedings of the 19th National Information Systems Security Conference, volume 1, pages 361-370, October 1996.
20. Symantec. Security response - CodeRed II. http://tinyurl.com/89t0.
21. Symantec. Security response - W32.Novarg.Amm. http://tinyurl.com/21v95.
22. Jamie Twycross and Matthew M. Williamson. Implementing and testing a virus throttle. In Proceedings of the 12th USENIX Security Symposium, August 4-8, 2003.
23. Luis von Ahn, Manuel Blum, and John Langford. Telling humans and computers apart (automatically) or how lazy cryptographers do AI. Technical Report CMUCS-02-117, February 2002.
24. Abraham Wald. Sequential Analysis. J. Wiley & Sons, New York, 1947.
25. Nicholas Weaver, Vern Paxson, Stuart Staniford, and Robert Cunningham. A taxonomy of computer worms. In Proceedings of the 2003 ACM Workshop on Rapid Malcode, pages 11-18. ACM Press, October 27, 2003.
26. Nicholas Weaver, Stuart Staniford, and Vern Paxson. Very fast containment of scanning worms. In Proceedings of the 13th USENIX Security Symposium, August 9-13, 2004.
27. Matthew M. Williamson. Throttling viruses: Restricting propagation to defeat malicious mobile code. In Proceedings of The 18th Annual Computer Security Applications Conference (ACSAC 2002), December 9-13, 2002.