Effective worm detection for various scan techniques

Abstract

Abstract-In recent years, the threats and damages caused by active worms have become more and more serious. In order to reduce the loss caused by fastspreading active worms, an effective detection mechanism to quickly detect worms is desired. In this paper, we first explore various scan strategies used by worms on finding vulnerable hosts. We show that targeted worms spread much faster than random scan worms. We then present a generic worm detection architecture to monitor malicious worm activities. We propose and evaluate our detection mechanism called Victim Number Based Algorithm. We show that our detection algorithm is effective and able to detect worm events before 2% of vulnerable hosts are infected for most scenarios. Furthermore, in order to reduce false alarms, we propose an integrated approach using multiple parameters as indicators to detect worm events. The results suggest that our integrated approach can differentiate worm attacks from DDoS attacks and benign scans.

PC Worm Detection System Based on the Correlation between User Interactions and Comprehensive Network Behaviors

“…We denote each as U1 through U5 (user applications), W1 through W5 (worms), and M1 through M5 (updates or daemons). We include 5 Windows-based worms of representative samples based on their scanning strategy [16], [28] as shown in Table 3. However we cannot exploit Linux worm because it's not working on Windows system.…”

“…EarlyBird system [15] automatically generates potential worm signatures by inspecting traffic patterns and relationships between sources and destinations addresses. Xia et al [16] demonstrated how to detect worms by analyzing packets with unused destination addresses.…”

A Tour of the Computer Worm Detection Space

“…Relies only on ARP activity; does not correlate ARP requests and replies; [24] History based IP worm detection Source addresses of connection requests are unlikely to have been seen at the network previously; [25] Victim Number based approach Random scanning techniques used by worms induce a large number of packets to inactive addresses or inactive services…”

Stochastic analysis of horizontal IP scanning

“…, F m , where F i is given to host i ∈ M. If each of F i is an ordered subset of F, we call this arrangement a block-split. In the context of the Internet, a pre-permutation scanner [4], [25] first applies partitioning g 2 to F and then permutes each F i using some algorithm g 1 to produce the final assignment [3], [8], [18], [19], [20], [28], [42], [44] first applies permutation g 1 to F and then partitions list…”