Sciweavers

IWIA
2003
IEEE

Designing a Framework for Active Worm Detection on Global Networks

13 years 9 months ago
Designing a Framework for Active Worm Detection on Global Networks
Past active Internet worms have caused widespread damage. Knowing the connection characteristics of such a worm very early in its proliferation cycle might provide first responders an opportunity to intercept a global scale epidemic. We are presenting a scalable framework for detecting, in near-realtime, active Internet worms on global networks, both public and private. By aggregating network error messages resulting from failed attempts at packet delivery, we are able to infer deviant connection behavior of hosts on interconnected networks. The Internet Control Message Protocol (ICMP) provides such error notification. Using a potentially unlimited number of collectors and analyzers, we identify ‘blooms’ of activity. The connection characteristics of these ‘blooms’ are then correlated to identify worm-like behavior, and an alert is raised. Promising results have been produced with a simulated Internet worm, demonstrating that new worms can be detected within the first few m...
Vincent Berk, George Bakos, Robert Morris
Added 04 Jul 2010
Updated 04 Jul 2010
Type Conference
Year 2003
Where IWIA
Authors Vincent Berk, George Bakos, Robert Morris
Comments (0)