Title

The monitoring and early detection of Internet worms

Authors

Authors

C. C. Zou; W. B. Gong; D. Towsley;L. X. Gao

Comments

Authors: contact us about adding a copy of your work at STARS@ucf.edu

Abbreviated Journal Title

IEEE-ACM Trans. Netw.

Keywords

computer network security; early detection; Internet worm; network; monitoring; Computer Science, Hardware & Architecture; Computer Science, Theory &; Methods; Engineering, Electrical & Electronic; Telecommunications

Abstract

After many Internet-scale worm incidents in recent years, it is clear that a simple self-propagating worm can quickly spread across the Internet and cause severe damage to our society. Facing this great security threat, we need to build an early detection system that can detect the presence of a worm in the Internet as quickly as possible in order to give people accurate early warning information and possible reaction time for counteractions. This paper first presents an Internet worm monitoring system. Then, based on the idea of "detecting the trend, not the burst" of monitored illegitimate traffic, we present a "trend detection" methodology to detect a worm at its early propagation stage by using Kalman filter estimation, which is robust to background noise in the monitored data. In addition, for uniform-scan worms such as Code Red, we can effectively predict the overall vulnerable population size, and estimate accurately how many computers are really infected in the global Internet based on the biased monitored data. For monitoring a nonuniform scan worm, especially a sequential-scan worm such as Blaster, we show that it is crucial for the address space covered by the worm monitoring system to be as distributed as possible.

Journal Title

Ieee-Acm Transactions on Networking

Volume

13

Issue/Number

5

Publication Date

1-1-2005

Document Type

Article

Language

English

First Page

961

Last Page

974

WOS Identifier

WOS:000233270900003

ISSN

1063-6692

Share

COinS