Containment of network worms via per-process rate-limiting

Abstract

Network worms pose a serious threat to the Internet infrastructure as well as end-users. Various techniques have been proposed for detection of, and response against worms. A frequently-used and automated response mechanism is to rate-limit outbound worm traffic while maintaining the operation of legitimate applications, offering a gentler alternative to the usual detect-and-block approach. However, most rate-limiting schemes to date only focus on host-level network activities and impose a single threshold on the entire host, failing to (i) accommodate network-intensive applications and (ii) effectively contain network worms at the same time. To alleviate these limitations, we propose a per-process-based containment framework in each host that monitors the fine-grained runtime behavior of each process and accordingly assigns the process a suspicion level generated by a machine-learning algorithm. We have also developed a heuristic to optimally map each suspicion level to the rate-limiting threshold. The framework is shown to be effective in containing network worms and allowing the traffic of legitimate programs, achieving lower false-alarm rates.

Behaviour based botnet detection with traffic analysis and flow intervals at the host level

“…As demonstrated Zeng et al in [12], proposed an individual host-level preservation system. Each hostspecific containment system includes two elements: i) behaviour analysis component and ii) containment model.…”

Hybrid Botnet Detection Based on Host and Network Analysis

“…In [12], Zeng et al proposed a per-process level containment technique for each host in the monitored network. e per-process containment consists of two components: behavior analysis component and containment model.…”

“…However, our proposed solution, which is hybrid solution based on network and host analysis, outperforms existing solutions in terms of accuracy rate and false positive rate. e works in [9,12] utilize the effectiveness of host level analysis for more accurate results. ese approaches, as our approach, monitored registry and file system in each host.…”