Effective worm detection for various scan techniques
Effective worm detection for various scan techniques
复制标题
针对各种扫描技术的有效蠕虫检测
DOI：
--
复制
发表时间：
2006
期刊：
影响因子：
--
通讯作者：
K. Kwiat
中科院分区：
文献类型：
--
作者：
Jianhong Xia;Sarma Vangala;Jiang Wu;Lixin Gao;K. Kwiat
近年来，主动蠕虫所造成的威胁和危害越来越严重。为了减少快速传播的活跃蠕虫造成的损失，需要一种有效的检测机制来快速检测蠕虫。在本文中，我们首先探讨了各种扫描策略使用的蠕虫发现脆弱的主机。我们发现，有针对性的蠕虫传播速度比随机扫描蠕虫。然后，我们提出了一个通用的蠕虫检测体系结构，以监测恶意蠕虫活动。我们提出并评估我们的检测机制，称为受害者数量为基础的算法。我们表明，我们的检测算法是有效的，能够检测到蠕虫事件之前，2%的脆弱主机被感染的大多数情况下。此外，为了减少误报，我们提出了一个综合的方法，使用多个参数作为指标来检测蠕虫事件。结果表明，我们的综合方法可以区分蠕虫攻击DDoS攻击和良性扫描。
In recent years, the threats and damages caused by active worms have become more and more serious. In order to reduce the loss caused by fast-spreading active worms, an effective detection mechanism to quickly detect worms is desired. In this paper, we first explore various scan strategies used by worms on finding vulnerable hosts. We show that targeted worms spread much faster than random scan worms. We then present a generic worm detection architecture to monitor malicious worm activities. We propose and evaluate our detection mechanism called Victim Number Based Algorithm. We show that our detection algorithm is effective and able to detect worm events before 2% of vulnerable hosts are infected for most scenarios. Furthermore, in order to reduce false alarms, we propose an integrated approach using multiple parameters as indicators to detect worm events. The results suggest that our integrated approach can differentiate worm attacks from DDoS attacks and benign scans.