Design and Evaluation of a Fast and Robust Worm Detection Algorithm

Abstract

Abstract-Fast spreading worms are a reality, as amply demonstrated by worms such as Slammer, which reached its peak propagation in a matter of minutes. With these kinds of fast spreading worms, the traditional approach of signature-based detection is no longer sufficient. Specifically, these worms can infect all vulnerable hosts well before a signature is available. To counter them, we must devise fast detection algorithms that can detect new worms without signatures as they first begin to appear. We present the design and evaluation of such an algorithm in this paper.The key to the algorithm is the identification of certain invariant characteristics of worm propagation. Specifically, we are able to demonstrate using real network traces how worm propagation can perturb the arrival process distribution of unsolicited packets. Our algorithm employs a novel two-step procedure that combines a first stage change point detection with a second stage growth rate inference to confirm the existence of a worm.To evaluate the algorithm, we have applied it to multi-year network traces that cover many of the major worm outbreaks in recent years, including Slammer, Witty, Nimda and Blaster. In all cases, the new algorithm is able to detect the worm within a very short time, well before significant infection has taken place.

Toward worm detection in online social networks

“…Bu et al suggested a worm detection scheme [17] based on the extraction of the alteration of arrival unsolicited scan rates in the early stage of worm propagation. Their work suggested a novel signal indicating the outbreak of an Internet worm, but this approach suffers from the problem of too many potential sources for false positive rate.…”

Internet Epidemics: Attacks, Detection and Defenses, and Trends

“…Internet worm tomography, however, cannot be translated into the linear inverse problem due to the complexity of epidemic spreading, and therefore presents new challenges. Several statistical detection and estimation techniques have been applied to Internet worm tomography, such as maximum likelihood estimation (39), Kalman filter estimation (48), and change-point detection (2). Figure 6 further illustrates an example of Internet worm tomography on estimating when a host gets infected, i.e., the host infection time, from our previous work (39).…”

Distinct Counting With a Self-Learning Bitmap

“…For example, in modern high speed networks, data traffic in the form of packets can arrive at the network link in the speed of gigabits per second, creating a massive data stream. A sequence of packets between the same pair of source and destination hosts and their application protocols form a flow, and the number of distinct network flows is an important monitoring metric for network health (for example, the early stage of worm attack often results a significant increase in the number of network flows as infected machines randomly scan others, see Bu et al (2006)). As another example, it is often useful to monitor connectivity patterns among network hosts and count the number of distinct peers that each host is communicating with over time (Karasaridis et al, 2007), in order to analyze the presence of peer-to-peer networks that are used for file sharing (e.g.…”