Sciweavers

Share
DIMVA
2006

A Fast Worm Scan Detection Tool for VPN Congestion Avoidance

9 years 1 months ago
A Fast Worm Scan Detection Tool for VPN Congestion Avoidance
Finding the cause for congested virtual private network (VPN) links that connect an office network over the Internet to remote subsidiaries can be a hassle. Scan traffic of worm infected hosts is one important possible cause. We developed a scan detection tool, which continuously monitors network traffic on VPN gateway(s) and that reliably detects and reports worm infected hosts by tracking anomalous TCP, UDP and ICMP traffic. Our tool is not sensitive to most P2P software and was successfully tested on real production traffic as well as with traces of captured real and simulated worm traffic. Our various tests demonstrated a low false positive rate and a high detection rate. Our open source tool is an extension to the free intrusion detection system Bro. It was developed jointly by ETH Zurich and Open Systems, a company offering managed security services, one of which is based on the presented worm scan detection tool.
Arno Wagner, Thomas Dübendorfer, Roman Hiesta
Added 30 Oct 2010
Updated 30 Oct 2010
Type Conference
Year 2006
Where DIMVA
Authors Arno Wagner, Thomas Dübendorfer, Roman Hiestand, Christoph Göldi, Bernhard Plattner
Comments (0)
books