An Efficient Signature-Based Approach for Automatic Detection of Internet Worms over Large-Scale Networks

Simkhada, Kumar; Taleb, Tarik; Waizumi, Yuji; Jamalipour, Abbas; Kato, Nei; Nemoto, Y.

doi:10.1109/icc.2006.255123

Cited by 5 publications

(10 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The authors proposed a signature-based worm detection system over large scale networks in [10]. The system consists of hierarchically placed local security managers, metropolitan security managers, and a global security manager, as shown in Fig.…”

Section: Background and System Performance Metricsmentioning

confidence: 99%

“…The experiment is carried out using the results obtained during the evaluation of the worm-detection IDS proposed in [10]. During the suspicious flow collection process, the IDS extracts N S sample strings of length L S from each incoming network flow and counts the occurrence frequency of each sample string.…”

Section: A Experimental Set-upmentioning

confidence: 99%

“…The corresponding FNA, FPA, and PO rates are then used to evaluate the performance of the proposed scheme. We obtain the FNA and FPA rates directly from preliminary experiments which are presented in [10]. PO rate is defined as the percentage of the worm payload that is necessary to generate the signature under the selected scenario.…”

Section: A Experimental Set-upmentioning

confidence: 99%

“…The authors propose a signature-based hierarchical worm detection technique for large scale networks in [10] and a multiple-substrings signature generation approach in [11]. These systems deploy several parameters in order to enforce suitable security policies.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

NIS08-1: A Multi-level Security Based Autonomic Parameter Selection Approach for an Effective and Early Detection of Internet Worms

et al. 2006

Self Cite

View full text Add to dashboard Cite

In light of the fast propagation of recent Internet worms, human intervention in securing the Internet during worm outbreaks is of little significance. In order to reduce the damage worms may cause, existing Intrusion Detection Systems (IDSs) need to be adaptive to the security-related requirements of their monitoring networks. This paper presents a Multilevel security based Autonomic Parameter Selector (MAPS) that can be implemented over any existing IDSs. The deployment architecture consists of a number of hierarchically placed local security managers, metropolitan security managers, and a global security manager. These security managers report events to a Worm Advisory System (WAS). WAS accordingly sets the threat level of the network. Based on this level, MAPS selects the most optimum parameters for the entire IDS to combat against the propagating worm. The MAPS architecture maintains the system performance by constantly evaluating three metrics, namely False Negative Avoidance, False Positive Avoidance, and Performance Overhead. Extensive experiments, using real network traffic and a recently proposed worm detection system, demonstrate that MAPS is capable of advising an IDS with optimum parameter values to effectively and promptly hinder further propagation of worms.

show abstract

Section: Background and System Performance Metricsmentioning

confidence: 99%

Section: A Experimental Set-upmentioning

confidence: 99%

Section: A Experimental Set-upmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

NIS08-1: A Multi-level Security Based Autonomic Parameter Selection Approach for an Effective and Early Detection of Internet Worms

et al. 2006

Self Cite

View full text Add to dashboard Cite

show abstract

“…In addition, a time-out period is implemented in both the lists to purge older instances of the attacks. The DMU also possesses a list of worm signatures [6] that have either already been detected in the domain or have been defined for the system.…”

Section: B Working Principle Of the Security Elementsmentioning

confidence: 99%

A Detection and Recovery Architecture Against DoS and Worm Attacks in NGMN

Hashim

Kibria

Jamalipour

2008

2008 IEEE International Conference on Communications

View full text Add to dashboard Cite

This paper addresses potential security threats that arise from the interconnection of different access technologies in Next Generation Mobile Networks (NGMN). A generic hierarchical security architecture is proposed that is capable of detecting and isolating the dominant security threats namely denialof-service (DoS), distributed DoS (DDoS) and worm attacks. The architecture utilizes an anomaly-based security detection mechanism, which resolves the attacks through a cooperative approach between the node under attack and its corresponding higher tier nodes. The results from the ns-2 based simulation indicate that the proposed security architecture is capable of mitigating these threats in an effective manner.

show abstract

Securing the next generation mobile network

Hashim

Kibria

Jamalipour

2008

Security Comm Networks

Self Cite

View full text Add to dashboard Cite

Despite well-defined security models to prevent fraudulent intrusion, a number of security attacks have been reported in literature for legacy networks. While a section of these attacks are due to inherent design limitations, others stem from the pervasive introduction of Internet Protocol (IP)-based applications and external attacks. The former can be addressed by the continual evolution of the system (as is the case with existing systems) whereas the latter requires careful designing. With the advent of all-IP next generation mobile network (NGMN) inter-connecting disparate access technologies, the design process assumes paramount importance in relation to detecting/preventing/eliminating migration of attacks through infected terminals. Taking into consideration the fact that standardization bodies are responsible for individual network evolution, a cooperative NGMN security architecture is proposed in this paper that identifies and isolates/eliminates security attacks. The cooperation is encased by the network elements within the NGMN hierarchy and utilizes an anomaly-based attack detection mechanism. Several dominant security attacks are simulated to demonstrate the effectiveness of the proposed architecture.

show abstract

An Efficient Signature-Based Approach for Automatic Detection of Internet Worms over Large-Scale Networks

Cited by 5 publications

References 14 publications

NIS08-1: A Multi-level Security Based Autonomic Parameter Selection Approach for an Effective and Early Detection of Internet Worms

NIS08-1: A Multi-level Security Based Autonomic Parameter Selection Approach for an Effective and Early Detection of Internet Worms

A Detection and Recovery Architecture Against DoS and Worm Attacks in NGMN

Securing the next generation mobile network

Contact Info

Product

Resources

About