NDLI: An integrated approach to detection of fast and slow scanning worms

Please wait, while we are loading the content...

Securing virtual machine monitors: what is needed?

Automatic discovery of botnet communities on large-scale communication networks

Efficient IRM enforcement of history-based access control policies

On the feasibility of launching the man-in-the-middle attacks on VoIP from remote attackers

On-board credentials with open provisioning

Universally composable contributory group key exchange

Unconditionally secure message transmission in arbitrary directed synchronous networks tolerating generalized mixed adversary

Efficient zero-knowledge identification schemes which respect privacy

Expressive policy analysis with enhanced system dynamicity

Confidentiality-preserving distributed proofs of conjunctive queries

Conditional proxy re-encryption secure against chosen-ciphertext attack

Logging key assurance indicators in business processes

A note on Cook's elastic block cipher

Assured information sharing between trustworthy, semi-trustworthy and untrustworthy coalition partners

Automating analysis of large-scale botnet probing events

Lightweight self-protecting JavaScript

A generic construction of useful client puzzles

Flexible μTPMs through disembedding

Universal forgery of the identity-based sequential aggregate signature scheme

Formalizing information security knowledge

Quantifying maximal loss of anonymity in protocols

Semantic context aware security policy deployment

D-algebra for composing access control policy decisions

An ID-based authenticated key exchange protocol based on bilinear Diffie-Hellman problem

Anonymous user communication for privacy protection in wireless metropolitan mesh networks

A conceptual framework for Group-Centric secure information sharing

Towards complete node enumeration in a peer-to-peer botnet

An integrated approach to detection of fast and slow scanning worms

A chipset level network backdoor: bypassing host-based firewall & IDS

Partnership in key exchange protocols

The union-split algorithm and cluster-based anonymization of social networks

PBES: a policy based encryption system with application to data sharing in the power grid

Toward practical analysis for trust management policy

Provably secure and efficient bounded ciphertext policy attribute based encryption

Delegate predicate encryption and its application to anonymous authentication

Intrusion response cost assessment methodology

Authenticated wireless roaming via tunnels: making mobile guests feel at home

TimeVM: a framework for online intrusion mitigation and fast recovery using multi-time-lag traffic replay

Hidden credential retrieval from a reusable password

Attribute based proxy re-encryption with delegating capabilities

A new hash family obtained by modifying the SHA-2 family

Improved searchable public key encryption with designated tester

An integrated approach to detection of fast and slow scanning worms

Content Provider	ACM Digital Library
Author	Kranakis, Evangelos Lambadaris, Ioannis Akujobi, Frank
Abstract	The propagation speed of fast scanning worms and the stealthy nature of slow scanning worms present unique challenges to intrusion detection. Typically, techniques optimized for detection of fast scanning worms fail to detect slow scanning worms, and vice versa. In practice, there is interest in developing an integrated approach to detecting both classes of worms. In this paper, we propose and analyze a unique integrated detection approach capable of detecting and identifying traffic flow(s) responsible for simultaneous fast and slow scanning malicious worm attacks. The approach uses a combination of evidence from distributed host-based anomaly detectors, a self-adapting profiler and Bayesian inference from network heuristics to detect intrusion activity due to both fast and slow scanning worms. We assume that the extreme nature of fast scanning worm epidemics make them well suited for extreme value theory and use sample mean excess function to determine appropriate thresholds for detection of such worms. Random scanning worm behavior is considered in analyzing the stochastic time intervals that affect behavior of the detection technique. Based on the analysis, a probability model for worm detection interval using the detection scheme was developed. Simulations are used to validate our assumptions and analysis.
Starting Page	80
Ending Page	91
Page Count	12
File Format	PDF
ISBN	9781605583945
DOI	10.1145/1533057.1533071
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2009-03-10
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Probability model Detection interval Intrusion detection Bayesian inference Anomaly detection Worms
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

An Integrated Approach to Detection of Fast and Slow Scanning Worms (2009)

Two Stratum Bayesian Network Based Anomaly Detection Model for Intrusion Detection System

Detection of slow malicious worms using multi-sensor data fusion

Fast Detection of Stealth and Slow Scanning Worms in Transmission Control Protocol

Endpoint-Driven Intrusion Detection and Containment of Fast Spreading Worms in Enterprise Networks

Method for network anomaly detection based on Bayesian statistical model with time slicing

Anomaly-Based Intrusion Detection Using Bayesian Networks

Network Anomaly Intrusion Detection Using a Nonparametric Bayesian Approach and Feature Selection

An Approach to Detect Executable Content for Anomaly Based Network Intrusion Detection

An integrated approach to detection of fast and slow scanning worms

Similar Documents

An Integrated Approach to Detection of Fast and Slow Scanning Worms (2009)

Two Stratum Bayesian Network Based Anomaly Detection Model for Intrusion Detection System

Detection of slow malicious worms using multi-sensor data fusion

Fast Detection of Stealth and Slow Scanning Worms in Transmission Control Protocol

Endpoint-Driven Intrusion Detection and Containment of Fast Spreading Worms in Enterprise Networks

Method for network anomaly detection based on Bayesian statistical model with time slicing

Anomaly-Based Intrusion Detection Using Bayesian Networks

Network Anomaly Intrusion Detection Using a Nonparametric Bayesian Approach and Feature Selection

An Approach to Detect Executable Content for Anomaly Based Network Intrusion Detection

An integrated approach to detection of fast and slow scanning worms