Internet worm early detection and response mechanism

doi:1005-8885 (2007) 03-0079-06

Acta Metallurgica Sinica(English letters) ›› 2007, Vol. 14 ›› Issue (3): 79-84.doi: 1005-8885 (2007) 03-0079-06

• Artificial Intelligence • 上一篇下一篇

Internet worm early detection and response mechanism

王健;刘衍珩;田大新;魏达

College of Computer Science and Technology, Jilin University,
Changchun 130012, China

收稿日期:2006-10-25 修回日期:1900-01-01 出版日期:2007-09-30

Internet worm early detection and response mechanism

WANG Jian; LIU Yan-heng; TIAN Da-xin; WEI Da

College of Computer Science and Technology, Jilin University,
Changchun 130012, China

Received:2006-10-25 Revised:1900-01-01 Online:2007-09-30

摘要/Abstract

摘要：

In recent years, fast spreading worm has become one of the major threats to the security of the Internet and has an increasingly fierce tendency. In view of the insufficiency that based on Kalman filter worm detection algorithm is sensitive to interval, this article presents a new data collection plan and an improved worm early detection method which has some deferent intervals according to the epidemic worm propagation model, then proposes a worm response mechanism for slowing the wide and fast worm propagation effectively. Simulation results show that our methods are able to detect worms accurately and early.

关键词:

worm; early detection; Kalman filter; worm propagation model

Abstract:

Key words:

worm; early detection; Kalman filter; worm propagation model

中图分类号:

TP393

WANG Jian; LIU Yan-heng; TIAN Da-xin; WEI Da. Internet worm early detection and response mechanism[J]. Acta Metallurgica Sinica(English letters), 2007, 14(3): 79-84.

参考文献

1. Seeley D. A tour of the worm. Proceedings of the Winter USENIX Conference, Jan 17-21 1989, San Diego, CA, USA. 1989: 287-304

2. Morre D, Shannon C, Claffy K. Code-red: a case study on the spread and victims of an Internet worm. Proceedings of the 2nd ACM SIGCOMM Workshop on Internet Measurement, Nov 06-08, 2002, Marseille, France. New York, NY, USA: ACM, 2002: 273-284

3. Moore D, Paxson V, Savage S, et al. Inside the Slammer worm. IEEE Security and Privacy, 2003, 1(4): 33-39

4. Moore D, Shannon C, Voelker G M, et al. Network Telescopes. CAIDA, Tech Rep TR-2004-04, 2004

5. Berk V H, Gray RS, Bakos G. Using sensor networks and data fusion for early detection of active worms. Proceedings of SPIE AeroSense Symposium, Apr 21-25, 2003, Orlando, FL, USA. 2003: 92-104

6. Chen Shi-gang, Ranka S. Detecting Internet worms at early stage. IEEE Journal on Selected Areas in Communications, 2005, 23(10): 2003-2012

7. Christopher G, Richard B. A note on the spread of worms in scale-free networks. IEEE Transactions on Systems, Man, and Cybernetics, Part B: Cybernetics, 2006, 36(1): 198-202

8. Zou C C, Gong W, Towsley D. Code red worm propagation modeling and analysis. Proceedings of the 9th ACM Conference on Computer and Communications Security, Nov 18-22, 2002, Washington, DC, USA. New York, NY, USA: ACM, 2002: 138-147

9. Morre D, Shannon C, Voelker G M, et al. Internet quarantine: requirements for containing self-propagating code. Proceedings of IEEE INFOCOM’03, Apr 1-3, 2003, San Francisco, CA, USA. Piscataway, NJ, USA: IEEE. 2003: 1901-1910

10. Zou C C, Gong W, Towsley D. Worm propagation modeling and analysis under dynamic quarantine defense. Proceedings of the ACM Workshop on Rapid Malcode (WORM’03), Oct 27, Washington, DC, USA. New York, NY, USA: ACM, 2003: 51-60

11. Wu J, Vangala S, Gao L, et al. An efficient architecture and algorithm for detecting worms with various scan techniques. Proceedings of the 11th Annual Network and Distributed System Security Symposium (NDSS’04), Feb 5-7, 2004, San Diego, CA, USA: 2004

12. Zou C C, Gao L, Gong W, et al. Monitoring and early warning for internet worms. Proceedings of the 10th ACM Conference on Computer and Communications Security. Oct 27-30, 2003, Washington, DC, USA. New York, NY, USA: ACM, 2003: 190-199

13. Zou C C, Gong W, Towsley D, et al. The Monitoring and Early Detection of Internet Worms. IEEE/ACM Transactions on Networking, 2005, 13(5): 961-974

14. Yang G, Rong C M, Peng L. A novel approach for redirecting module in honeypot systems. The Journal of Beijing University of Posts and Telecommunications, 2005, 23(3): 58-62 (in Chinese)

15. Goldsmith D. Maillist: Possible codered connection attempts. (2001-07-20). http://lists.jammed.com/incidents/2001/07 /0149.html

16. Eichman K. Maillist: Re: possible codered connection attempts. (2001-07-20) http://lists.jammed.com/incidents/2001/07/ 0159.html

[1]	李文王文博景晓军刘文. Optimizing CMT performance by joint predictions of bandwidth and RTT [J]. Acta Metallurgica Sinica(English letters), 2015, 22(4): 81-91.
[2]	舒坚陶娟刘林岚谌业滨藏超. CCI-based link quality estimation mechanism for wireless sensor networks under non-perceived packet loss[J]. Acta Metallurgica Sinica(English letters), 2013, 20(1): 1-10.
[3]	姜向远张焕水王伟. NLOS error mitigation with information fusion algorithm for UWB ranging systems[J]. Acta Metallurgica Sinica(English letters), 2012, 19(2): 22-29.
[4]	TANG Xin 王汝传 SHAO Xing. Modeling and Analysis of anti-worm in P2P networks[J]. Acta Metallurgica Sinica(English letters), 2012, 19(1): 112-118.
[5]	周非何伟俊 FAN Xin-yue. Tracking application about singer model based on marginalized particle filter[J]. Acta Metallurgica Sinica(English letters), 2010, 17(4): 47-51.
[6]	苏飞林昭文马严. Modeling and analysis of Internet worm propagation[J]. Acta Metallurgica Sinica(English letters), 2010, 17(4): 63-68.

Internet worm early detection and response mechanism

Internet worm early detection and response mechanism

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 6

编辑推荐

Metrics

本文评价