NDLI: Modeling and Detection of Camouflaging Worm

Please wait, while we are loading the content...

Modeling and Detection of Camouflaging Worm

Content Provider	IEEE Xplore Digital Library
Author	Wei Yu Xun Wang Calyam, P. Dong Xuan Wei Zhao
Copyright Year	2004
Abstract	Active worms pose major security threats to the Internet. This is due to the ability of active worms to propagate in an automated fashion as they continuously compromise computers on the Internet. Active worms evolve during their propagation, and thus, pose great challenges to defend against them. In this paper, we investigate a new class of active worms, referred to as Camouflaging Worm (C-Worm in short). The C-Worm is different from traditional worms because of its ability to intelligently manipulate its scan traffic volume over time. Thereby, the C-Worm camouflages its propagation from existing worm detection systems based on analyzing the propagation traffic generated by worms. We analyze characteristics of the C-Worm and conduct a comprehensive comparison between its traffic and nonworm traffic (background traffic). We observe that these two types of traffic are barely distinguishable in the time domain. However, their distinction is clear in the frequency domain, due to the recurring manipulative nature of the C-Worm. Motivated by our observations, we design a novel spectrum-based scheme to detect the C-Worm. Our scheme uses the Power Spectral Density (PSD) distribution of the scan traffic volume and its corresponding Spectral Flatness Measure (SFM) to distinguish the C-Worm traffic from background traffic. Using a comprehensive set of detection metrics and real-world traces as background traffic, we conduct extensive performance evaluations on our proposed spectrum-based detection scheme. The performance data clearly demonstrates that our scheme can effectively detect the C-Worm propagation. Furthermore, we show the generality of our spectrum-based scheme in effectively detecting not only the C-Worm, but traditional worms as well.
Sponsorship	IEEE Computer Society
Starting Page	377
Ending Page	390
Page Count	14
File Size	1522270
File Format	PDF
ISSN	15455971
Volume Number	8
Issue Number	3
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2011-05-01
Publisher Place	U.S.A.
Access Restriction	One Nation One Subscription (ONOS)
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Computer worms Internet Computer networks Large-scale systems Telecommunication traffic Frequency domain analysis Density measurement Power measurement Volume measurement Recruitment anomaly detection. Worm camouflage
Content Type	Text
Resource Type	Article
Subject	Computer Science Electrical and Electronic Engineering

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

On Detecting Camouflaging Worm

Worm Detection in Large Scale Network by Traffic

Camouflage Worm Detection and Counter-Measures

On Detecting Camouflaging Worm

On detecting camouflaging worm.

The spread of the Witty worm

Modeling and Automated Containment of Worms

Modeling the Spread of Worm Epidemics in Vehicular Ad Hoc Networks

The monitoring and early detection of Internet worms

Modeling and Detection of Camouflaging Worm

Similar Documents

On Detecting Camouflaging Worm

Worm Detection in Large Scale Network by Traffic

Camouflage Worm Detection and Counter-Measures

On Detecting Camouflaging Worm

On detecting camouflaging worm.

The spread of the Witty worm

Modeling and Automated Containment of Worms

Modeling the Spread of Worm Epidemics in Vehicular Ad Hoc Networks

The monitoring and early detection of Internet worms

Modeling and Detection of Camouflaging Worm