Enhancing SWORD to Detect Zero-Day-Worm-Infected Hosts

Abstract

Once a host is infected by an Internet worm, prompt action must be taken before that host does more harm to its local network and the rest of the Internet. It is therefore critical to quickly detect that a worm has infected a host. In this paper, we enhance our SWORD system to allow for the detection of infected hosts and evaluate its performance. This enhanced version of SWORD inherits the advantages of the original SWORD: it does not rely on inspecting traffic payloads to search for worm byte patterns or setting up a honeypot to lure worm traffic. Furthermore, while acting as a host-level detection system, it runs at a network's gateway and stays transparent to individual hosts. We show that our enhanced SWORD system is able to quickly and accurately detect if a host is infected by a zero-day worm. Furthermore, the detection is shown to be effective against worms of different types and speeds, including polymorphic worms

Online Accumulation: Reconstruction of Worm Propagation Path

“…In the related works, we mention that enabling a detection algorithm to execute in real-time usually exploits sliding windows [4,17]. The Accumulation Algorithm is able to promptly obtain the detection results and thus provides an ameliorate condition for online tracing.…”

Integrated detection of active worms using multi-sensor data fusion and collaborative network defense

“…Hence, collaboration through gossips provided a way to remedy this by allowing multiple detectors share information to provide better coverage. In [65] the SWORD (Self-propagating Worm Observation and Rapid Detection) detection system was proposed to detect zero-day worms of different propagation types and speeds. This was achieved by determining whether total number of outgoing worm-like connections from a domain during a sliding window crosses a threshold set based on observation of normal traffic.…”

“…We emulated slow worms with scanning rates of 5 hosts per minute (h/m) and lOh/m for our experiments. Slow worm rates and thresholds in the order of this magnitude have been used in previous works[65] [22]. Fast worms were emulated with scanning rates of 15 hosts per second (h/s) and 20h/s.…”