On the adaptive real-time detection of fast-propagating network worms

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 4579 LNCS, Issue , 2007, Pages 175-192

  Jung, Jaeyeon ^a   Milito, Rodolfo A ^b   Paxson, Vern ^c  

^a Mazu Networks ^*

^b Consentry Networks ^*

^c LAWRENCE BERKELEY NATIONAL LABORATORY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ADAPTIVE CONTROL SYSTEMS; ALGORITHMS; COMPUTER VIRUSES; INTERNET;

ENGINEER DETECTORS; FALSE-NEGATIVE; PROBABILITY OF FAILURE (TRW); RATE-BASED SEQUENTIAL HYPOTHESIS TESTING;

REAL TIME SYSTEMS;

EID: 37849024155     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-73614-1_11     Document Type: Conference Paper

References (20)

1. Nmap - free security scanner for network exploration & security audits, http://www.insecure.org/nmap/
2. Chen, S., Tang, Y.: Slowing Down Internet Worms. In: Proceedings of the 24th International Conference on Distributed Computing Systems (ICDCS'04) Tokyo, Japan (March 2004)
3. Ehtereal.com. Ethereal, http://www.ethereal.com/
4. Eichin, M.W., Rochlis, J.A.: With Microscope and Tweezers: An Analysis of the Internet Virus of November 1988. In: Proceedings of the IEEE Symposium on Research in Security and Privacy (1989)
5. F-Secure. F-Secure Virus Descriptions: Santy, http://www.f-secure.com/v- descs/santy_a.shtml
6. Jung, J., Paxson, V., Berger, A. W., and Balakrishnan, H. Fast Portscan Detection Using Sequential Hypothesis Testing. In: Proceedings of the IEEE Symposium on Security and Privacy (May 9-12, 2004)
7. Kim, H.-A., Karp, B.: Autograph: Toward Automated Distributed Worm Signature Detection. In: Proceedings of the 13th USENIX Security Symposium (August 9-13, 2004)
8. Schechter, S.E., Jung, J., Berger, A.W.: Fast Detection of Scanning Worm Infections. In: Jonsson, E., Valdes, A., Almgren, M. (eds.) RAID 2004. LNCS, vol. 3224, Springer, Heidelberg (2004)
9. Singh, S., Estan, C., Varghese, G., and Savage, S. Automated Worm Fingerprinting. In: Proceedings of the 13th Operating Systems Design and Implementation OSDI (December 2004)
10. Spafford, E. H. A Failure to Learn from the Past. In: Proceedings of the 19th Annual Computer Security Applications Conference. December 8-12, 2003 pp. 217-233 (2003)
11. Staniford, S., Paxson, V., Weaver, N.: How to Own the Internet in Your Spare Time. In: Proceedings of the 11th USENIX Security Symposium Berkeley, CA, USA, August 5-9, 2002 USENIX Association, pp. 149-170 (2002)
12. Turkey, J.W.: A survey of sampling from contaminated distributions. In: Contributions to Probability and Statistics, Stanford University Press (1960)
13. Twycross, J., Williamson, M.M.: Implementing and Testing a Virus Throttle. In: Proceedings of the 12th USENIX Security Symposium (August 4-8, 2003)
14. Wald, A.: Sequential Analysis. J. Wiley & Sons, New York (1947)
15. Wang, K., Cretu, G., Stolfo, S.J: Anomalous payload-based worm detection and signature generation. In: Valdes, A., Zamboni, D. (eds.) RAID 2005. LNCS, vol. 3858, Springer, Heidelberg (2006)
16. Weaver, N., Paxson, V., Staniford, S., Cunningham, R.: A Taxonomy of Computer Worms. In: Proceedings of the 2003 ACM Workshop on Rapid Malcode, October 27, 2003, pp. 11-18. ACM Press, New York (2003)
17. Weaver, N., Staniford, S., and Paxson, V. Very Fast Containment of Scanning Worms. In: Proceedings of the 13th USENIX Security Symposium (August 9-13, 2004)
18. Whyte, D., Kranakis, E., van Oorschot, P.: DNS-based Detection of Scanning Worms in an Enterprise Network. In: Proceedings of the Network and Distributed System Security Symposium (NDSS'05) (February 2005)
19. Williamson, M. M. Throttling Viruses: Restricting propagation to defeat malicious mobile code. In: Proceedings of The 18th Annual Computer Security Applications Conference (ACSAC 2002) (December 9-13, 2002)
20. Wong, C., Bielski, S., Studer, A., Wang, C.: Empirical analysis of rate limiting mechanisms. In: Valdes, A., Zamboni, D. (eds.) RAID 2005. LNCS, vol. 3858, Springer, Heidelberg (2006)