Design and Evaluation of a Fast and Robust Worm Detection Algorithm

— Fast spreading worms are a reality, as amply demonstrated by worms such as Slammer, which reached its peak propagation in a matter of minutes. With these kinds of fast spreading worms, the traditional approach of signature-based detection is no longer sufficient. Specifically, these worms can infect all vulnerable hosts well before a signature is available. To counter them, we must devise fast detection algorithms that can detect new worms without signatures as they first begin to appear. We present the design and evaluation of such an algorithm in this paper. The key to the algorithm is the identification of certain invariant characteristics of worm propagation. Specifically, we are able to demonstrate using real network traces how worm propagation can perturb the arrival process distribution of unsolicited packets. Our algorithm employs a novel two-step procedure that combines a first stage change point detection with a second stage growth rate inference to confirm the exi...

• Type: Conference
• Year: 2006
• Where: INFOCOM
• Authors: Tian Bu, Aiyou Chen, Scott A. Vander Wiel, Thomas Y. C. Woo
• Keywords: Algorithm, Communications, Fast Spreading, INFOCOM 2006, Worm Propagation