ARP-based Detection of Scanning Worms Within an Enterprise Network
ARP-based Detection of Scanning Worms Within an Enterprise Network
复制标题
基于 ARP 的企业网络内扫描蠕虫检测
DOI：
--
复制
发表时间：
2005
期刊：
影响因子：
--
通讯作者：
E. Kranakis
中科院分区：
文献类型：
--
作者：
D. Whyte;P. V. Oorschot;E. Kranakis
快速传播的蠕虫可以说是当前Internet面临的最大安全威胁。迄今为止，蠕虫编写者已经成功地穿透了大多数安全对策。基于特征的检测方案通常无法检测零日蠕虫，并且它们对新威胁的快速反应能力有限，因为它们通常需要某种形式的人工参与来制定更新的攻击特征。我们提出了一种基于异常的检测技术，旨在保护内部网络扫描蠕虫感染。这是公开文献中的第一篇出版物（据我们所知），提出并详细描述了一种检测单个网络单元内扫描蠕虫传播的方法。我们表明，这种技术是准确和快速的，足以使自动遏制和抑制蠕虫在网络细胞内的传播。在软件中实现，我们的检测方法依赖于一个聚合的异常分数，从地址解析协议（阿普）活动的相关性从各个网络连接的设备。我们的初步分析和原型表明，这种技术可以用来快速检测零日蠕虫在一个非常小的扫描次数，例如三次扫描的假阳性率为五个在我们的测试环境中的两个星期内。在培训期间自动生成必要的个人阿普活动系统配置文件，因此可以快速部署软件，只需最少的调整和管理。
Rapidly propagating worms are arguably the greatest security threat currently facing the Internet. To date, worm writers have been successful in penetrating most security countermeasures. Signature-based detection schemes often fail to detect zero-day worms, and their ability to rapidly react to new threats is limited as they typically require some form of human involvement to formulate updated attack signatures. We propose an anomaly-based detection technique designed to protect internal networks from scanning worm infections. This is the first publication in the open literature (to our knowledge) proposing and providing a detailed description of a method to detect propagation of scanning worms within individual network cells. We show that this technique is both accurate and rapid enough to enable automatic containment and suppression of worm propagation within a network cell. Implemented in software, our detection approach relies on an aggregate anomaly score, derived from the correlation of Address Resolution Protocol (ARP) activity from individual network attached devices. Our preliminary analysis and prototype indicate that this technique can be used to rapidly detect zero-day worms within a very small number of scans, e.g. three scans with a false positive rate of five over a two week period in our test environment. The necessary individual ARP activity system profiles are automatically generated during a training period and thus the software can be rapidly deployed with minimal tuning and administration.