Design and evaluation of a fast and robust worm detection algorithm

Proceedings - IEEE INFOCOM

Volumn , Issue , 2006, Pages

  Bu, Tian ^a   Chen, Aiyou ^a   Wiel, Scott Vander ^a,b   Woo, Thomas ^a  

^a LUCENT TECHNOLOGIES   (United States)

^b LOS ALAMOS NATIONAL LABORATORY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER WORMS; INTRUSION DETECTION;

ARRIVAL PROCESS DISTRIBUTION; WORM DETECTION ALGORITHM;

ALGORITHMS;

EID: 39049102892     PISSN: 0743166X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/INFOCOM.2006.100     Document Type: Conference Paper

References (23)

1. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver, "The spread of the sapphire/slammer worm," 2003.
2. S. Staniford, V. Paxson, and N. Weaver, "How to own the internet in your spare time," in USENIX Security Symposium, 2002.
3. C. C. Zou, W. Gong, D. Towsley, and L. Gao, "The monitoring and early detection of internet worms," IEEE/ACM Transactions on Networking.
4. G. Gu, M. Sharif, X. Qin, D. Dagon, W. Lee, and G. Riley, "Worm detection, early warning and response based on local victim information," in Annual Computer Security Applications Conference, (Tucson, Arizona), dec 2004.
5. J. Wu, S. Vangala, L. Gao, and K. Kwiat, "An effective architecture and algorithm for detecting worms with various scan techniques," in Network and Distributed System Security Symposium, Feb 2004.
6. J. Jung, V. Paxson, A. Berger, and H. Balakrishnan, "Fast portscan detection using sequential hypothesis testing," in IEEE Symposium on Security and Privacy, may 2004.
7. N. Weaver, S. Staniford, and V. Paxson, "Very fast containment of scanning worms," in USENIX Security Symposium, aug 2004.
8. S. Singh, C. Estan, G. Varghese, and S. Savage, "Automated worm fingerprinting," in ACM/USENIX Symposium on Operating System Design and Implementation, Dec 2004.
9. C. Shannon and D. Moore, 'The spread of the witty worm," 2004.
10. D. Moore and C. Shannon, "Code-red worms: A global threat," 2002.
11. "Symantec early warning solutions."
12. "Internet storm center."
13. D. Moore, C. Shannon, G. M. Voelker, and S. Savag, "Network telescopes," 2002.
14. "Honeynet project: know your enemy."
15. D. Dagon, X. Qin, G. Gu, W. Lee, J. Grizzard, J. Levine, and H. Owen, "Honeystat: Local worm detection using honeypots," in Recent Advances In Intrusion Detection (RAID), 2004.
16. H. Wang, D. Zhang, and K. G. Shin, "Change-point monitoring for detection of dos attacks," IEEE Transactions on Dependable and Secure Computing, vol. 1, no. 4, 2004.
17. V. Yegneswaran, P. Barford, and J. Ullrich, "Internet intrusions: Global characteristics and prevalence," in ACM SIGMETRICS, 2003.
18. M. Basseville and I. Nikiforov, Detection of Abrupt Changes, Theory and Application. Prentice Hall, 1993.
19. P. Andersen, Q. Borgan, R. Gill, and N. Keiding, Statistical Models Based on Counting Processes. Springer-Verlag, 1992.
20. P. Bickel and K. Doksum, Mathematical Statistics, Basic Ideas and Selected Topics, Vol. I, second edition. Prentice Hall, 2001.
21. D. Lambert and C. Liu, "Dynamic thresholding: monitoring streams of network counts online," in Journal of The American Statistical Association, to appear, 2006.
22. C. Jin, H. Wang, and K. Shin, "Hop-count filtering: An effective defense against spoofed dos traffic," in ACM International Conference on Computer and Communications Security (CCS), Oct. 2003.
23. F. Gan and K. Choi, "Computing average run lengths for exponential cusum schemes source," Journal of Quality Technology, vol. 26, no. 2, pp. 134-143.