Title

The Monitoring And Early Detection Of Internet Worms

Keywords

Computer network security; Early detection; Internet worm; Network monitoring

Abstract

After many Internet-scale worm incidents in recent years, it is clear that a simple self-propagating worm can quickly spread across the Internet and cause severe damage to our society. Facing this great security threat, we need to build an early detection system that can detect the presence of a worm in the Internet as quickly as possible in order to give people accurate early warning information and possible reaction time for counteractions. This paper first presents an Internet worm monitoring system. Then, based on the idea of "detecting the trend, not the burst" of monitored illegitimate traffic, we present a "trend detection" methodology to detect a worm at its early propagation stage by using Kalman filter estimation, which is robust to background noise in the monitored data. In addition, for uniform-scan worms such as Code Red, we can effectively predict the overall vulnerable population size, and estimate accurately how many computers are really infected in the global Internet based on the biased monitored data. For monitoring a nonuniform scan worm, especially a sequential-scan worm such as Blaster, we show that it is crucial for the address space covered by the worm monitoring system to be as distributed as possible. © 2005 IEEE.

Publication Date

10-1-2005

Publication Title

IEEE/ACM Transactions on Networking

Volume

13

Issue

5

Number of Pages

961-974

Document Type

Article

Personal Identifier

scopus

DOI Link

https://doi.org/10.1109/TNET.2005.857113

Socpus ID

28044469549 (Scopus)

Source API URL

https://api.elsevier.com/content/abstract/scopus_id/28044469549

This document is currently not available here.

Share

COinS