No abstract

No abstract

Abstract-Fast spreading worms are a reality, as amply demonstrated by worms such as Slammer, which reached its peak propagation in a matter of minutes. With these kinds of fast spreading worms, the traditional approach of signature-based detection is no longer sufficient. Specifically, these worms can infect all vulnerable hosts well before a signature is available. To counter them, we must devise fast detection algorithms that can detect new worms without signatures as they first begin to appear. We present the design and evaluation of such an algorithm in this paper.The key to the algorithm is the identification of certain invariant characteristics of worm propagation. Specifically, we are able to demonstrate using real network traces how worm propagation can perturb the arrival process distribution of unsolicited packets. Our algorithm employs a novel two-step procedure that combines a first stage change point detection with a second stage growth rate inference to confirm the existence of a worm.To evaluate the algorithm, we have applied it to multi-year network traces that cover many of the major worm outbreaks in recent years, including Slammer, Witty, Nimda and Blaster. In all cases, the new algorithm is able to detect the worm within a very short time, well before significant infection has taken place.

Impulse oscillometry offers an advantage over spirometry when conducting pulmonary function tests. Not only does it require minimal patient cooperation, it provides useful data in a form amenable to engineering methods. In particular, the data can be used to obtain parameter estimates for electric circuit-based models of the respiratory system, which can in turn aid the detection and diagnosis of various diseases/pathologies. Of the six models analyzed during this study, the DuBois model and a newly proposed extended RIC model seem to provide the most robust parameter estimates for our entire data set of 106 subjects with various respiratory ailments such as asthma and chronic obstructive pulmonary disease. Such a diagnostic approach, relying on estimated parameter values, may require additional measures to ensure proper identification of diseases/pathologies but the preliminary results are promising.

No abstract