Sciweavers

Share
IJISEC
2006

A monitoring system for detecting repeated packets with applications to computer worms

10 years 4 months ago
A monitoring system for detecting repeated packets with applications to computer worms
Abstract We present a monitoring system which detects repeated packets in network traffic, and has applications including detecting computer worms. It uses Bloom filters with counters. The system analyzes traffic in routers of a network. Our preliminary evaluation of the system involved traffic from our internal lab and a well known historical data set. After appropriate configuration, no false alarms are obtained under these data sets and we expect low false alarm rates are possible in many network environments. We also conduct simulations using real Internet Service Provider topologies with realistic link delays and simulated traffic. These simulations confirm that this approach can detect worms at early stages of propagation. We believe our approach, with minor adaptations, is of independent interest for use in a number of network applications which benefit from detecting repeated packets, beyond detecting worm propagation. These include detecting network anomalies such as dangerous...
Paul C. van Oorschot, Jean-Marc Robert, Miguel Var
Added 12 Dec 2010
Updated 12 Dec 2010
Type Journal
Year 2006
Where IJISEC
Authors Paul C. van Oorschot, Jean-Marc Robert, Miguel Vargas Martin
Comments (0)
books