Detecting Worm Propagation Using Traffic Concentration Analysis and Inductive Learning

As a vast number of services have been flooding into the Internet, it is more likely for the Internet resources to be exposed to various hacking activities such as Code Red and SQL Slammer worm. Since various worms quickly spread over the Internet using self-propagation mechanism, it is crucial to detect worm propagation and protect them for secure network infrastructure. In this paper, we propose a mechanism to detect worm propagation using the computation of entropy of network traffic and the compilation of network traffic. In experiments, we tested our framework in simulated network settings and could successfully detect worm propagation.

• Type: Conference
• Year: 2004
• Where: IDEAL
• Authors: Sanguk Noh, Cheolho Lee, Keywon Ryu, Kyunghee Choi, Gihyun Jung
• Keywords: IDEAL 2004, Network Traffic, SQL Slammer Worm, Worm Propagation