d-ACTM/VT: A Distributed Virtual AC Tree Detection Method

Abstract

In this paper, we propose d-ACTM/VT, a network-based worm detection method that effectively detects hit-list worms using distributed virtual AC tree detection. To detect a kind of hit-list worms named Silent worms in a distributed manner, d-ACTM was proposed. d-ACTM detects the existence of worms by detecting tree structures composed of infection connections as edges. Some undetected infection connections, however, can divide the tree structures into small trees and degrade the detection performance. To address this problem, d-ACTM/VT aggregates the divided trees as a tree named Virtual AC tree in a distributed manner and utilizes the tree size for detection. Simulation result shows d-ACTM/VT reduces the number of infected hosts before detection by 20% compared to d-ACTM.

Hit-list Worm Detection Using Distributed Sliding Window

“…In the evaluation, we assess the effect of T w on the detection performance. T H AC is adjusted to 30 to achieve the given false alert interval using the threshold-adjusting algorithm 2) .…”

“…Kawaguchi, et al proposed a method called d-ACTM/VT 2) , for detecting hit-list worms that attack internal hosts in an enterprise network by finding their propagation trees in a distributed manner. A propagation tree represents a worm's propagation routes in a network.…”