A real-time worm outbreak detection system using shared counters

Proceedings - 15th Annual IEEE Symposium on High-Performance Interconnects, HOT Interconnects

Volumn , Issue , 2007, Pages 65-72

  Faezipour, Miad ^a   Nourani, Mehrdad ^a   Panigrahy, Rina ^b  

^a UNIVERSITY OF TEXAS AT DALLAS   (United States)

^b MICROSOFT RESEARCH   (United States)

Author keywords

False negative; False positive; Hashing; Network intrusion detection system; Polymorphic worm; Repeated strings; Shared counters; Worm outbreak

Indexed keywords

FALSE POSITIVE (FP); MEMORY COST; NETWORK INTRUSION DETECTION SYSTEMS (NIDS); NETWORKING APPLICATIONS; OUTBREAK DETECTION; PACKET STREAMS; POLYMORPHIC WORMS; TIME FRAMES;

COMPUTER CRIME; INTERNET; RIVERS; SECURITY OF DATA; SENSORS; SIGNAL DETECTION;

INTRUSION DETECTION;

EID: 46449121365     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/HOTI.2007.2     Document Type: Conference Paper

References (21)

1. S. Staniford, D. Moore, V. Paxson and N. Weaver, "The Top Speed of Flash Worms," in Proceedings of the ACM Workshop on Rapid Malcode (WORM'04), pp. 33-42, Oct. 2004.
2. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford and N. Weaver "The Spread of the Sapphire/Slammer Worm," http://www.caida.org/ publications/papers/2003/sapphire/sapphire.html.
3. D. Song, R. Malan and R. Stone, "A Snapshot of Global Internet Worm Activity," Technical Report Arbor Networks, Nov. 2001.
4. C. C. Zou, W. Gong and D. Towsley, "Code Red Worm Propagation Modeling and Analysis," in Proceedings of the 9th ACM Conference on Computer and Communications Security (SIGSAC02), pp. 138-147, Nov. 2002.
5. P. Akritidis, K. Anagnostakis and E. P. Markatos, "Efficient Content-Based Detection of Zero-Day Worms," in Proceedings of the IEEE International Conference on Communications (ICC'05), vol. 2, pp. 837-843, May 2005.
6. J. Newsome, B. Karp and D. Song, "Polygraph: Automatically Generating Signatures for Polymorphic Worms," in Proceedings of the IEEE Symposium on Security and Privacy (SP'05), pp. 226-241, May 2005.
7. SNORT Network Intrusion Detection System, www.snort.org.
8. O. Kolesnikov and W. Lee, "Advanced Polymorphic Worms: Evading IDS by Blending in with Normal Traffic," Technical Report, Georgia Institute of Technology, Sep. 2005.
9. C. C. Zou, N. Duffield, D. Towsley and W. Gong, "Adaptive Defense Against Various Network Attacks," in IEEE Journal on Selected Areas in Communications, vol. 24, no. 10, pp. 1877-1888, Oct. 2006.
10. B. Madhusudan, J. Lockwood, "Design of a System for Real-Time Worm Detection," in Proceedings of the 12th Annual IEEE Symposium on High Performance Interconnects (HOTI'04), pp. 77-83, Aug. 2004.
11. F. Yu, R. H. Katz and T. V. Lakshman, "Gigabit Rate Packet Pattern-Matching Using TCAM," in Proceedings of the 12th IEEE International Conference on Network Protocols Symposium on High Performance Interconnects (ICNP'04), pp. 174-183, 2004.
12. H. Song, J. W. Lockwood, "Multi-pattern Signature Matching for Hardware Network Intrusion Detection Systems," in Proceedings of the IEEE Global Telecommunications Conference (GLOBECOM'05), vol. 3, pp. 1686-1690, Dec. 2005.
13. S. Singh, C. Estan, G. Varghese and S. Savage, "Automated Worm Fingerprinting," in Proceedings of the ACM Symposium on Operating System Design and Implementation (OSDI'04), pp. 45-60, Dec. 2004.
14. M. Charikar, K. Chen and M. Farach-Colton, "Finding Frequent Items in Data Streams," Special Issue on Automata, Languages and Programming, vol. 312 pp. 3-15, Jan. 2004.
15. P. B. Gibbons and Y Matias, "New Sampling-Based Summary Statistics for Improving Approximate Query Answers," in Proceedings of the ACM SIGMOD'98 Conference, vol. 27, pp. 331-342, June 1998.
16. H. A. Kim and B. Karp, "Autograph: Toward Automated, Distributed Worm Signature Detection," in Proceedings of 13th USENIX Security Symposium, pp. 271-286 , Aug. 2004.
17. S. Schleimer, D. S. Wilkerson and A. Aiken, "Winnowing: Local Algorithms for Document Fingerprinting," in Proceedings of the ACM SIGM OD'03 Conference, pp. 76-85 , June 2003.
18. B. Bloom, "Space/Time Trade-offs in Hash Coding with Allowable Errors," in Comm. ACM, vol. 13, no. 7, pp. 422-426, July 1970.
19. C. Estan and G. Varghese, "New Directions in Traffic Measurement and Accounting," in Proceedings of the ACM SIGCOMM'02 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, pp. 323-336, Aug. 2002.
20. V. Karamcheti, D. Geiger, Z. Kedem and S. Muthukrishnan, "Detecting Malicious Network Traffic Using Inverse Distributions of Packet Contents," in Proceedings of ACM SIGCOMM'05 MineNet Workshop, pp. 165-170, Aug. 2005.
21. Polynomials, http://www.theory.cs.uvic.ca/cos/gen/poly.html.