DNS-based Detection of Scanning Worms in an Enterprise Network

Proceedings of the Symposium on Network and Distributed System Security, NDSS 2005

Volumn , Issue , 2005, Pages

  Whyte, David ^a   Kranakis, Evangelos ^a   van Oorschot, P C ^a  

^a CARLETON UNIVERSITY   (Canada)

Author keywords

[No Author keywords available]

Indexed keywords

INTERNET PROTOCOLS;

DOMAIN NAME SYSTEM; ENTERPRISE NETWORKS; FALSE POSITIVE RATES; FIRST MILE; RAPID DETECTION; SCANNING WORMS; SECURITY THREATS; WORM DETECTION; WORM PROPAGATION; ZERO DAY WORMS;

ZERO-DAY ATTACK;

EID: 85068681376     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (28)

1. Forescout. Wormscout. http://www.forescout.com/wormscout.html.
2. Mirage Networks. http://www.miragenetworks.com.
3. Optixpro trojan horse. http://securityresponse1.symantec.com/sarc/sarc.nsf/html/backdoor.optixpro.12.html.
4. Secure Shell Protocol (secsh). http://www.ietf.org/html.charters/secsh-charter.html; accessed on October 24, 2004.
5. tcpdump/libpcap public repository. http://www.tcpdump.org.
6. August was Worst Month Ever for Viruses, Worms. Technet News, September 2003.
7. Worm containment in the internal network. Technical report, Silicon Defense, 2003.
8. M. Crispin. Internet Message Access Protocol. March 2003. http://www.ietf.org/rfc/rfc3501.txt?number=3501; accessed October 22, 2004.
9. D. Ellis, J. Aiken, K. Attwood, and S. Tenaglia. A behavioral approach to worm detection. In To Appear in Proceedings of The Workshop on Rapid Malcode, 2003.
10. G. Granger, G. Economou, and S. Bielski. Self-securing network interfaces: What, why and how. Technical report, Carnegie Mellon Iniversity, CMU-CS-02-144, May 2002.
11. J. Jung, V. Paxson, A. Berger, and H. Balakrishman. Fast portscan detection using sequential hypothesis testing. In 2004 IEEE Symposium on Security and Privacy, 2004.
12. C. Kruegel, T. Toth, and E. Kirda. Service specific anomaly detection for intrusion detection. Technical report, TU-1841-2002-28, 2002.
13. D. Mills. Network Time Protocol (Version 3). RFC, March 1992. http://www.ietf.org/rfcs/rfc1305.txt?number=1305; accessed October 24, 2004.
14. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver. Inside the slammer worm. In IEEE Magazine of Security and Privacy, pages 33-39, July/August 2003.
15. D. Moore, C. Shannon, G. Voelker, and S. Savage. Internet quarantine: Requirements for containing self-propagating code. In Proceedings of the 2003 IEEE Infocom Conference, San Francisco, CA, April 2003.
16. R. Pethia. Attacks on the Internet 2003. Congressional Testimony, Subcommittee on Telecommunications and the Internet, November 2003.
17. D. Plummer. An Ethernet Address Resolution Protocol. RFC, November 1982. http://www.ietf.org/rfc/rfc0826.txt?number= 826; accessed on October 24, 2004.
18. J. Postel and J. Reynolds. File Transfer Protocol (FTP). RFC, October 1985. http://www.ietf.org/rfc/rfc959. txt?number=959; accessed October 24, 2004.
19. C. Shannon and D. Moore. The spread of the witty worm. Technical report, CAIDA, March 2004.
20. S. Staniford. Containment of scanning worms in enterprise networks. In Journal of Computer Science, to appear, 2004.
21. S. Staniford, V. Paxson, and N. Weaver. How to 0wn the internet in your spare time. In Proceedings of the 11th USENIX Security Symposium, August 2002.
22. N. Weaver. Potential strategies for high speed active worms: A worst case analysis. 2002. http://www.cs.berkeley.edu/nweaver/worms.pdf; last accessed October 20, 2004.
23. N. Weaver and D. Ellis. Reflections on Witty. ;login: The USENIX Magazine, 29(3):34-37, June 2004.
24. N. Weaver, V. Paxson, S. Staniford, and R. Cunningham. A taxonomy of computer worms. In The First ACM Workshop on Rapid Malcode (WORM), October 2003.
25. N. Weaver, S. Staniford, and V. Paxson. Very fast containment of scanning worms. In Proceedings of the 13th USENIX Security Symposium, 2004.
26. D. Whyte, E. Kranakis, and P. C. van Oorschot. Arpbased detection of scanning worms in an enterprise network. Technical report, School of Computer Science, Carleton University, October 2004.
27. M. Williamson. Throttling viruses: Restricting propagation to defeat malicious mobile code. In Annual Computer Security Applications Conference, 2002.
28. C. Zou, L. Gao, W. Gong, and D. Towsley. Monitoring and early warning for Internet worms. In In Proceedings of the 10th ACM Conference on Computer and Communications Security, 2003.