Detecting worm propagation using traffic concentration analysis and inductive learning

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 3177, Issue , 2004, Pages 402-408

  Noh, Sanguk ^a   Lee, Cheolho ^b   Ryu, Keywon ^c   Choi, Kyunghee ^c   Jung, Gihyun ^c  

^a The Catholic University of Korea   (South Korea)

^b National Security Research Institute (NSRI)   (South Korea)

^c Ajou University   (South Korea)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 35048841284     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-28651-6_59     Document Type: Article

References (15)

1. Berk, V.H. et al.: Using Sensor Networks and Data Fusion for Early Detection of Active Worms. SPIE AeroSense, 2003.
2. Clark, P. and Niblett, T.: The CN2 Induction Algorithm. Machine Learning Journal 3, 261-283, 1989.
3. Danyliw, R. and Householder, A.: CERT Advisory CA-2001-19 "Code Red" Worm Exploiting Buffer Overflow in US Indexing Service DLL. CERT Coordination Center, 2001.
4. Gray, R.M.: Entropy and Information Theory. Springer-Verlag, 39-40, 1990.
5. Hanson, R., Stutz, J., and Cheeseman, P.: Bayesian Classification Theory. Technical Report FIA-90-12-7-01, NASA Ames Research Center, AI Branch, 1991.
6. Holder, L.: ML v2.0: Machine Learning Program Evaluator. available on-line: http://www-cse.uta.edu/-holder/ftp/ml2.0.tar.gz.
7. Houle, J.K., and Weaver, M.G.: Trends in Denial of Service Attack Technology. CERT Coordination Center, 2001.
8. Lan, K. et al.: Effect of Malicious Traffic on the Network. PAM, 2003.
9. Lawrence Berkeley National Labs Network Research Group.: libpcap. available on-line: http://flp.ee.lbl.gov.
10. Moore, D. et al.: The Spread of the Sapphire/Slammer Worm, available on-line: http://www.cs.berkeley.edu/∼nweaver/sapphire/, 2003.
11. Noh, S. et al.: Detecting Distributed Denial of Service (DDoS) Attacks through Inductive Learning. Lecture Notes in Computer Science, Vol. 2690, Springer-Verlag, 286-295, 2003.
12. Quinlan, J.R.: C4.5: Programs for Machine Learning. Morgan Kaufmann Publishers (1993.
13. Standard Performance Evaluation Corporation: SPECweb99 Benchmark, available online: http://www.spec.org/osg/web99.
14. Toth, T. and Kruegel, C.: Connection-history based Anomaly Detection. The 2002 IEEE Workshop on Information Assurance and Security, 2002.
15. Valdes, A.: Entropy Characteristics of Propagating Internet Phenomena. The Workshop on Statistical and Machine Learning Techniques in Computer Intrusion Detection, 2003.