A survey of internet worm detection and containment

IEEE Communications Surveys and Tutorials

Volumn 10, Issue 1, 2008, Pages 20-35

  Li, Pele ^a   Salour, Mehdi ^a   Su, Xiao ^a  

^a SAN JOSE STATE UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

DETECTION ALGORITHM; FULLY AUTOMATED; FUTURE RESEARCH DIRECTIONS; HUMAN INTERACTIONS; INTERNET WORM DETECTION; SELF-PROPAGATING MALICIOUS CODES; WORM DETECTION;

SIGNAL DETECTION;

SURVEYS;

EID: 77953145744     PISSN: None     EISSN: 1553877X     Source Type: Journal    
DOI: 10.1109/COMST.2008.4483668     Document Type: Review

References (60)

1. E. Spafford, "The Internet Worm Program: An Analysis," Comp. Commun. Rev., 1989.
2. D. T. C. Zou, W. Gong, and S. Cai, "Routing Worm: A Fast, Selective Attack Worm Based on IP Address Information," Proc. 19th ACM/IEEE/SCS Wksp. Principles of Advanced and Distrib. Simulation, 2005.
3. C. J. Z. Chen, "A Self-Learning Worm Using Importance Scanning," Proc. ACM CCS Wksp. Rapid Malcode (WORM '05), 2005.
4. F. M. Moheeb Abu Rajab and Andreas Terzis, "On the Impact of Dynamic Addressing on Malware Propagation," Proc. ACM WORM '06, 2006.
5. V. P. S. Staniford and N. Weaver, "How to Own the Internet in Your Spare Time," Proc. 11th USENIX Sec. Symp., 2002.
6. D. M. S. Staniford, V. Paxson, and N. Weaver, "The Top Speed of Flash Worms," Proc. ACM WORM '04, 2004.
7. V. P. N. Weaver, S. Staniford, and R. Cunningham, "A Taxonomy of Computer Worms," Proc. ACM WORM '03, 2003.
8. J. M. Niels Provos and Ke Wang, "Search Worms," Proc. ACM WORM '06, 2006.
9. G. P. Schaffer, "Worms and Viruses and Botnets, Oh My! Rational Responses to Emerging Internet Threats," IEEE Sec. & Privacy, vol. 4, 2006, pp. 52-58.
10. J. Z. Moheeb Abu Rajab, F. Monrose, and A. Terzis, "A Multifaceted Approach to Understanding the Botnet Phenomenon," Proc. 6th ACM SIGCOMM on Internet Measurement, 2006.
11. E. C. Ying Zhang and Z. Morley Mao, "Internet-Scale Malware Mitigation: Combining Intelligence of the Control and Data Plane," Proc. ACM WORM '06, 2006.
12. V. P. D. Moore et al., "Inside the Slammer Worm," IEEE Sec. & Privacy, vol. 1, 2003, pp. 33-39.
13. D. G. Glazer, "Computer Worms," May 2005, http://www.research. umbc.edu/~dgorin1/is432/worms.htm
14. "Morris (Computer Worm)," retrieved July 2007, http://en.wikipedia.org/wiki/Morris-worm
15. "F-Secure Virus Descriptions: Nimda," retrieved July 2007, http://www.f-secure.com/v-descs/nimda.shtml, 2001
16. "CERT" Advisory CA-2001-26 Nimda Worm," retrieved July 2007, http://www.cert.org/advisories/CA-2001-26.html, 2001.
17. "F-Secure Computer Virus Information Pages: Slammer," vol. May, 2005, http://www.f-secure.com/v-descs/mssqlm.shtml
18. "Sasser Worm Analysis - LURHQ," May 2005, http://www.lurhq.com/ sasser.html
19. "Secunia - Virus Information - Sasser.G," May 2005, http://secunia.com/virus-information/11515/sasser.g
20. "F-Secure Computer Virus Information Pages: Witty," May 2005, http://www.f-secure.com/v-descs/witty.shtml
21. C. S. D. Moore, "The Spread of the Witty Worm," IEEE Sec. & Privacy, vol. 2, 2004, pp. 46-50.
22. R. A. et al., Snort 2.1 Intrusion Detection, 2nd ed., Syngress, O'Reilly, 2004, pp. 490-91.
23. S. E. D. Bolzoni and P. Hartel, "POSEIDON: A 2-Tier Anomaly-Based Network Intrusion Detection System," Proc. 4th IEEE Int'l Wksp. Info. Assurance, 2006.
24. "Snort," May 2005, http://www.snort.org
25. G. B. V. Berk and R. Morris, "Designing a Framework for Active Worm Detection on Global Networks," Proc. 1st IEEE Int'l. Wksp. Info. Assurance, 2003.
26. S. C. Y. Tang, "Slowing Down Internet Worms," Proc. 24th IEEE Int'l Conf. Distrib. Comp. Sys., 2004.
27. S. C. S. Ranka, "An Internet-Worm Early Warning System," Proc. IEEE GLOBECOM, 2004.
28. S. S. J. Jung, A. Berger, "Fast Detection of Scanning Worm Infections," Proc. 7th Int'l Symp. Recent Advances in Intrusion Detection, 2004.
29. V. P. J. Jung et al., "Fast Portscan Detection Using Sequential Hypothesis Testing," Proc. IEEE Symp. Sec. and Privacy, 2004.
30. D. E. N. Weaver, S. Staniford, and V. Paxson, "Worms vs. Perimeters - The Case for Hard-LANs," Proc. 12th Annual IEEE Symp. High Perf. Interconnects, 2004.
31. M. S. G. Gu et al., "Worm Detection, Early Warning and Response Based on Local Victim Information," Proc. 20th Annual Comp. Sec. Apps. Conf., 2004.
32. D. D. X. Qin et al., "Worm Detection Using Local Networks," tech. rep., College of Computing, Georgia Tech, 2004.
33. C. E. S. Singh, G. Varghese, and S. Savage, "The EarlyBird System for Real-Time Detection of Unknown Worms," UCSD tech rep. CS2003-0761, 2003.
34. L. G. Z. Chen and K. Kwiat, "Modeling the Spread of Active Worms," Proc. IEEE Comp. and Commun. Societies Annual Joint Conf., 2003.
35. S. V. J. Wu, L. Gao, and K. Kwiat, "An Efficient Architecture and Algorithm for Detecting Worms with Various Scan Techniques," Proc. Network and Distrib. Sys. Sec. Symp., 2004.
36. L. Spitzner, Honeypot: Tracking Hackers, Addison-Wesley, 2002.
37. X. Q. D. Dagon et al., "Honeystat: Local Worm Detection Using Honeypots," Proc. 7th Symp. Recent Advances in Intrusion Detection, 2004.
38. "Honeyd Virtual Honeypot," retrieved Aug. 2005, http://honeyd.org
39. N. Provos, "A Virtual Honeypot Framework," Proc. 13th USENIX Sec. Symp., 2004.
40. P. K. C. Matthew V. Mahoney, "PHAD: Packet Header Anomaly Detection for Identifying Hostile Network Traffic," FL Inst. Tech. tech. rep. CS-2001-04, 2001.
41. S. J. S. Ke Wang, "Anomalous Payload-Based Network Intrusion Detection," Proc. Recent Advances in Intrusion Detection, 2004.
42. G. C. Ke Wang and Salvatore J. Stolfo, "Anomalous Payload-based Worm Detection and Signature Generation," Proc. 8th Int'l Symp. Recent Advances in Intrusion Detection, 2005.
43. B. M. J. Lockwood, "Design of a System for Real-Time Worm Detection," Proc. 12th IEEE Annual Symp. High Perf. Interconnects, 2004.
44. J. C. C. Kreibich, "Honeycomb - Creating Intrusion Detection Signatures Using Honeypots," Proc. 2nd Wksp. Hot Topics in Networks, 2003.
45. B. K. H. Kim, "Autograph: Toward Automated, Distributed Worm Signature Detection," Proc. 13th USENIX Sec. Symp., 2004.
46. B. K. J. Newsome and D. Song, "Polygraph: Automatically Generating Signatures for Polymorphic Worms," Proc. IEEE Symp. Sec. and Privacy, 2005.
47. P. A. S. Antonatos, E. P. Markatos, K. G. Anagnostakis, "Defending Against Hitlist Worms Using Network Address Space Randomization," Proc. ACM WORM '05, 2005.
48. A. L. Mohamed R. Chouchane, "Using Engine Signature to Detect Metamorphic Malware," Proc. ACM WORM '06, 2006.
49. J. C. R. Dantu and A. Yelimeli, "Dynamic Control of Worm Propagation," Proc. Int'l Conf. Info. Technology: Coding and Comp., 2004.
50. C. W. C. Wong et al., "Dynamic Quarantine of Internet Worms," Proc. Int'l Conf. Dependable Sys. and Networks, 2004.
51. C. S. D. Moore, G. M. Voelker, and S. Savage, "Internet Quarantine: Requirements for Containing Self-Propagating Code," Proc. IEEE INFOCOM, 2003.
52. L.-H. L. David Brumley, Pongsin Poosankam, and Dawn Song, "Design Space and Analysis of Worm Defense Strategies," Proc. ACM Symp. Info., Comp. and Commun. Sec., 2006.
53. S. S. N. Weaver and V. Paxson, "Very Fast Containment of Scanning Worms," Proc. 13th USENIX Sec. Symp., 2004.
54. B. Laing, "How To Guide-Implementing a Network Based Intrusion Detection System," retrieved July 2007, http://www.snort.org/docs/#deploy
55. D. J. M. a. M. D. Smith, "Exploiting Temporal Consistency to Reduce False Positives in Host-Based, Collaborative Detection of Worms," Proc. ACM WORM '06, 2006.
56. S. J. Stolfo, "Worm and Attack Early Warning," IEEE Sec. & Privacy, vol. 2, 2004, pp. 73-75.
57. "Worminator Projector," retrieved Apr., 2005, http://worminator.cs.columbia.edu/public/index.jsp
58. B. P. A. Wagner, "Entropy Based Worm and Anomaly Detection in Fast IP Networks," Proc. 14th IEEE WET ICE/STCA Sec. Wksp., 2005.
59. P. A. P. L. Briesemeister, "Automatically deducing Propagation Sequences that Circumvent a Collaborative Worm Defense," Proc. 25th IEEE Conf. Perf., Comp., and Commun., 2006.
60. M. E. D. Kienzle, "Recent Worms: A Survey and Trends," Proc. ACM WORM '03, 2003.