The monitoring and early detection of Internet worms
Abbreviated Journal Title
IEEE-ACM Trans. Netw.
Keywords
computer network security; early detection; Internet worm; network; monitoring; Computer Science, Hardware & Architecture; Computer Science, Theory &; Methods; Engineering, Electrical & Electronic; Telecommunications
Abstract
After many Internet-scale worm incidents in recent years, it is clear that a simple self-propagating worm can quickly spread across the Internet and cause severe damage to our society. Facing this great security threat, we need to build an early detection system that can detect the presence of a worm in the Internet as quickly as possible in order to give people accurate early warning information and possible reaction time for counteractions. This paper first presents an Internet worm monitoring system. Then, based on the idea of "detecting the trend, not the burst" of monitored illegitimate traffic, we present a "trend detection" methodology to detect a worm at its early propagation stage by using Kalman filter estimation, which is robust to background noise in the monitored data. In addition, for uniform-scan worms such as Code Red, we can effectively predict the overall vulnerable population size, and estimate accurately how many computers are really infected in the global Internet based on the biased monitored data. For monitoring a nonuniform scan worm, especially a sequential-scan worm such as Blaster, we show that it is crucial for the address space covered by the worm monitoring system to be as distributed as possible.
Journal Title
Ieee-Acm Transactions on Networking
Volume
13
Issue/Number
5
Publication Date
1-1-2005
Document Type
Article
Language
English
First Page
961
Last Page
974
WOS Identifier
ISSN
1063-6692
Recommended Citation
"The monitoring and early detection of Internet worms" (2005). Faculty Bibliography 2000s. 5860.
https://stars.library.ucf.edu/facultybib2000/5860
Comments
Authors: contact us about adding a copy of your work at STARS@ucf.edu