Combating against internet worms in large-scale networks: An autonomic signature-based solution

Security and Communication Networks

Volumn 2, Issue 1, 2009, Pages 11-28

  Simkhada, Kumar ^a   Taleb, Tarik ^b   Waizumi, Yuji ^b   Jamalipour, Abbas ^c   Nemoto, Yoshiaki ^b  

^a KDDI CORPORATION   (Japan)

^b TOHOKU UNIVERSITY   (Japan)

^c UNIVERSITY OF SYDNEY   (Australia)

Author keywords

Clustering; Internet worms; Network security; Worm signature

Indexed keywords

CLUSTER ANALYSIS; COMPUTER WORMS; ELECTRONIC MAIL; GLOBAL SYSTEM FOR MOBILE COMMUNICATIONS; MANAGERS; SECURITY SYSTEMS;

CLUSTERING; GLOBAL SECURITY; HIERARCHICAL ARCHITECTURES; INTERNET WORM; LARGE-SCALE NETWORK; PARAMETER SELECTION; SECURITY MANAGER; WORM SIGNATURES;

NETWORK SECURITY;

EID: 77951207806     PISSN: 19390114     EISSN: 19390122     Source Type: Journal    
DOI: 10.1002/sec.51     Document Type: Article

References (33)

1. CERT/CC Statistics 1988-2006. Available at: http://www.cert.org/stats/ cert-stats.html
2. Moore D, Paxson V, Savage S, Shannon C, Staniford S, Weaver N. Inside the slammer worm. IEEE Security and Privacy 2003; 1(4): 33-39.
3. Shannon C, Moore D. The spread of the witty worm. IEEE Security and Privacy 2004; 2(4): 46-50.
4. Yaneza JLA, Mantes C, Avena E. The trend of malware today: annual virus round-up and 2005 forecast. Annual Virus Roundup, Trend Micro. 2004.
5. Staniford S, Paxson V, Weaver N. How to Own the Internet in your spare time. In Proceedings of the 11th USENIX Security Symposium, San Francisco, CA, USA, August 2002.
6. Nazario J. Defense and detection strategies against Internet worms. Artech House, 2004.
7. Weaver N, Paxson V, Staniford S, Cunningham R. A taxonomy of computer worms. In Proceedings of the First Workshop on Rapid Malcode (WORM 2003), Washington DC, USA, October 2003.
8. Simkhada K, Taleb T, Waizumi Y, Jamalipour A, Kato N, Nemoto Y. An efficient signature-based approach for automatic detection of Internet worms over large-scale networks. In Proceedings of IEEE International Conference on Communications (ICC 2006), Istanbul, Turkey, June 2006.
9. Simkhada K, Taleb T, Waizumi Y, Jamalipour A, Hashimoto K, Kato N, Nemoto Y. A multi-level security based autonomic parameter selection approach for an effective and early detection of Internet worms. In Proceedings of the IEEE Globecom 2006, San Francisco, CA, USA, November 2006.
10. Simkhada K, Tsunoda H, Waizumi Y, Nemoto Y. Differencing worm flows and normal flows for automatic generation of worm signatures. In Proceedings of the 7th IEEE International Symposium on Multimedia (ISM2005), Irvine, CA, USA, December 2005.
11. Li P, Salour M, Su X. A survey of Internet worm detection and containment. IEEE Communications Surveys & Tutorials, 1st Quarter 2008.
12. Dagon D, Qin X, Gu G, Lee W, Grizzard J, Levine J, Owen H. Honey Stat: local worm detection using honeypots. Recent Advances in Intrusion Detection (RAID), Sophia Antipolis, France, September 2004.
13. Kreibich C, Crowcroft J. Honeycomb-creating intrusion detection signatures using honeypots. In Proceedings of the 2nd Workshop on Hot Topics in Networks (Hot-Nets-II), Cambridge, MA, USA, November 2003.
14. Schultz MG, Eskin E, Zadok E. Data mining methods for detection of new malicious executables. IEEE Symposium on Security and Privacy, Oakland, CA, USA, May 2001.
15. Newsome J, Song D. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In Proceedings of the 12th Annual Network and Distributed System Security Symposium, Alexandria, VA, USA, February 2005.
16. Evans D, Larochelle D. Improving security using extensible lightweight static analysis. IEEE Software January/February 2002, pp. 42-51.
17. Cowan C, Beattie S, Johansen J, Wagle P. Point Guard: protecting pointers from buffer overflow vulnerabilities. In Proceedings of 12th USENIX Security Symposium, Washington DC, USA, August 2003.
18. Akritidis P, Anagnostakis K, Markatos EP. Efficient contentbased detection of zero-day worms. In Proceedings of IEEE International Conference on Communications (ICC 2005), Seoul, Korea, May 2005.
19. Kim H, Karp B. Autograph: toward automated, distributed worm signature detection. In Proceedings of 13th USENIX Security Symposium, San Diego, CA, August 2004.
20. Singh S, Estan C, Varghese G, Savage S. The Early-Bird system for real-time detection of unknown worms. Technical Report CS2003-0761, University of California, San Diego, August 2003.
21. Newsome J, Karp B, Song D. Polygraph: automatically generating signatures for polymorphic worms. In IEEE Symposium on Security and Privacy, Oakland, CA, USA, May 2005.
22. Williamson MM. Design, implementation and test of an email virus throttle. In Proceedings of the 19th Annual Computer Security Applications Conference (ACSAC), Las Vegas, NV, USA, December 2003.
23. Costa M, Crowcroft J, Castro M, Rowstron A, Zhou L, Zhang L, Barham P. Vigilante: end-to-end containment of Internet worms. In Proceedings of the 20th ACM Special Interest Group on Data Communications (SIGCOMM'05), Philadelphia, PA, USA, August 2005.
24. Chen X, Heidemann J. Detecting early worm propagation through packet matching. Technical Report ISI-TR-2004-585, USC/Information Sciences Institute, Marina del Rey, CA, USA, February 2004.
25. Bhattacharya M, Hershkop S, Eskin E. MET: an experimental system for malicious email tracking. In Proceedings of the 2002 New Security Paradigms Workshop, Virginia Beach, VA, USA, September 2002.
26. Zou CC, Gong W, Towsley D. Feedback email worm defense system for enterprise networks. Technical Report TR-04-CSE-05, University of Massachusetts, April 2004.
27. Chen S, Tang Y. Slowing down Internet worms. In Proceedings of 24th International Conference on Distributed Computing Systems (ICDCS'04), Tokyo, Japan, March 2004.
28. Zou CC, Gong W, Towsley D, Gao L. The monitoring and early detection of Internet worms. IEEE/ACM Transactions on Networking 2005; 13(5): 961-974.
29. Yegneswaran V, Barford P, Jha S. Global intrusion detection in the DOMINO overlay system. In Proceedings of 11th Annual Network and Distributed System Security Symposium, San Diego, CA, USA, February 2004.
30. Janakiraman R, Waldvogel M, Zhang Q. Indra: a peer-to-peer approach to network intrusion detection and prevention. In Proceedings of 2003 IEEE WETICE Workshop on Enterprise Security, Linz, Austria, June 2003.
31. Fink GA, Chappell BL, Turner TG, O'Donoghue KF. A metrics-based approach to intrusion detection system evaluation for distributed real-time systems. In Proceedings of 10th International Workshop on Parallel and Distributed Real-Time Systems, FL, USA, April 2002.
32. Tanachaiwiwat S, Helmy A. VACCINE: war of the worms in wired and wireless networks. In Proceedings of IEEE INFOCOM 2006, Barcelona, Spain, April 2006.
33. Suzuki Y, Waizumi Y, Tsunoda H, Nemoto Y. A low cost worm detection technique based on flow payload similarity. In Proceedings of Web Information Systems and Technologies, Barcelona, Spain, March 2007.