A novel approach to detecting worms based on particle filter

Abstract

This paper presents a novel approach to detecting worms based on particle filter. The approach collects data through honeynet and uses CUSUM to detect the abnormal changes of counts of packet source address in a t sampling. If the change rate exceeds a certain threshold, it will activate particle filter to estimate its growth rate in order to confirm the existence of worms. The experimental results show that the approach can detect unknown worms quickly and contain the large-scale spread of worms if it combines with the intrusion detection system and firewall.