On detecting camouflaging worm

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn , Issue , 2006, Pages 235-244

  Yu, Wei ^a   Wang, Xun ^b   Calyam, Prasad ^c   Xuan, Dong ^b   Zhao, Wei ^a  

^a TEXAS A AND M UNIVERSITY   (United States)

^b The Ohio State University   (United States)

^c OHIO STATE UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CAMOUFLAGING WORM; NON-WORM TRAFFIC; SPECTRAL FLATNESS MEASURE (SFM);

POWER SPECTRAL DENSITY; SECURITY OF DATA; TELECOMMUNICATION TRAFFIC;

COMPUTER VIRUSES;

EID: 39049123320     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ACSAC.2006.36     Document Type: Conference Paper

References (26)

1. D. Moore, C. Shannon, and J. Brown, "Code-red: a case study on the spread and victims of an internet worm," in Proceedings of 2-th Internet Measurement Workshop (IMW), Marseille, France, November 2002.
2. D. Moore, V. Paxson, and S. Savage, "Inside the slammer worm," in IEEE Magazine of Security and Privacy, July 2003.
3. CERT, CERT/CC advisories, http://www.cert.org/advisories/.
4. W32/MyDoom.B Virus, http://www.us-cert.gov/cas/techalerts/TA04- 028A.html.
5. W32.Sircam.Worm@mm, http://www.symantec.com/avcenter/venc/data/ w32.sircam.worm@mm.html.
6. Worm.ExploreZip, http://www.symantec.com/avcenter/venc/data/worm. explore.zip.html.
7. P. R. Roberts, Zotob Arrest Breaks Credit Card Fraud Ring, http://www.eweek.com/article2/0,1895,1854162,00.asp.
8. C. C. Zou, W. Gong, and D. Towsley, "Code-red worm propagation modeling and analysis," in Proceedings of the 9-th ACM Conference on Computer and Communication Security (CCS), Washington DC, November 2002.
9. S. Staniford, V. Paxson, and N. Weaver, "How to own the internet in your spare time," in Proceedings of the 11-th USENIX Security Symposium, San Francisco, CA, August 2002.
10. Z. S. Chen, L.X. Gao, and K. Kwiat, "Modeling the spread of active worms," in Proceedings of the IEEE Conference on Computer Communications (INFOCOM), San Francisco, CA, March 2003.
11. M. Garetto, W. B. Gong, and D. Towsley, "Modeling malware spreading dynamics," in Proceedings of the IEEE Conference on Computer Communications (INFOCOM), San Francisco, CA, March 2003.
12. C. Zou, W. B. Gong, D. Towsley, and L. X. Gao, "Monitoring and early detection for internet worms," in Proceedings of the 10-th ACM Conference on Computer and Communication Security (CCS), Washington DC, October 2003.
13. S. Venkataraman, D. Song, P. Gibbons, and A. Blum, "New streaming algorithms for superspreader detection," in Proceedings of the 12-th IEEE Network and Distributed Systems Security Symposium (NDSS), San Diego, CA, Febrary 2005.
14. J. Wu, S. Vangala, and L. X. Gao, "An effective architecture and algorithm for detecting worms with various scan techniques," in Proceedings of the 11-th IEEE Network and Distributed System Security Symposium (NDSS), San Diego, CA, Febrary 2004.
15. SANS, Internet Storm Center, http://isc.sans.org/.
16. D. J. Daley and J. Gani, Epidemic Modeling: an Introduction, Cambridge University Press, 1999.
17. V. Yegneswaran, P. Barford, and D. Plonka, "On the design and utility of internet sinks for network abuse monitoring," in Proceeding of Symposium on Recent Advances in Intrusion Detection (RAID), Pittsburgh, PA, September 2003.
18. J. Jung, V. Paxson, A. W. Berger, and H. Balakrishnan, "Fast portscan detection using sequential hypothesis testing," in Proceedings of the 25-th IEEE Symposium on Security and Privacy, Oakland, CA, May 2004.
19. G. F. Gu, D. Dagon, M. I. Sharif X. Z. Qin, W. Lee, and G. F. Riley, "Worm detection, early warning, and response based on local victim information," in Proceedings of Proceedings of the 20-th Annual Computer Security Applications Conference (ACSAC 2004), Tucson, Arizona, December 2004.
20. S. Singh, C. Estan, G. Varghese, and S. Savage, "Automated worm fingerprinting," in Proceedings of the ACM/USENIX Symposium on Operating System Design and Implementation, San Francisco, CA, December 2004.
21. G. M. Voelker J. Ma and S. Savage, "Self-stopping worms," in Proceedings of the ACM Workshop on Rapid Malcode (WORM), Washington D.C, November 2005.
22. Linux.com, Understanding Stealth Scans: Forewarned is Forearmed, http://security.itworld.com/4363/LWD010321vcontrol3/page1.html.
23. Solar Designer, Designing and Attacking Port Scan Detection Tools, http://www.phrack.org/phrack/53/P53-13.
24. N. S. Jayant and P. Noll, Digital Coding of Waveforms, Prentice-Hall, 1984.
25. R. E. Yantorno, K. R. Krishnamachari, J. M. Lovekin, D. S. Benincasa, and S. J. Wenndt, "The spectral autocorrelation peak valley ratio (sapvr) - a usable speech measure employed as a co-channel detection system," in Proceedings of IEEE International Workshop on Intelligent Signal Processing (WISP), Budapest, Hungary, May 2001.
26. S. Theodoridis and K. Koutroumbas, Pattern Recognition, Second Edition, Elsevier Science, 2003.