Combating against internet worms in large-scale networks: an autonomic signature-based solution
Combating against internet worms in large-scale networks: an autonomic signature-based solution
复制标题
DOI：
10.1002/sec.51
复制
发表时间：
2009
期刊：
影响因子：
--
通讯作者：
K. Simkhada;T. Taleb;Yuji Waizumi;A. Jamalipour;Y. Nemoto
中科院分区：
文献类型：
--
作者：
K. Simkhada;T. Taleb;Yuji Waizumi;A. Jamalipour;Y. Nemoto
在本文中，我们提出了一个基于签名的分层电子邮件蠕虫检测（SHEWD）系统来检测大规模网络中的电子邮件蠕虫。该系统检测新的蠕虫，并立即生成他们的签名。此功能有助于检查任何已知或未知蠕虫的传播。我们设想一个两层的分层架构，包括本地安全管理器（LSMs），大都市安全管理器（MSM），和全球安全管理器（GSM）。当地管理人员收集可疑的流量，并将其交给大城市管理人员。然后，大都市管理人员使用聚类分析从可疑流中分类蠕虫。排序后的蠕虫被用来生成蠕虫签名，该签名被中继到全局管理器，然后被中继到所有协作网络。提出了一种单独的方案来自动选择合适的系统参数值。此参数选择过程考虑当前网络状态和正在进行的攻击的威胁级别。使用带有蠕虫痕迹的真实的网络流量对整个系统的性能进行了研究。实验结果表明，该方案能够准确地检测电子邮件蠕虫在其传播的早期阶段。版权所有© 2008约翰威利父子有限公司。
In this paper, we propose a signature-based hierarchical email worm detection (SHEWD) system to detect e-mail worms in large-scale networks. The proposed system detects novel worms and instantly generates their signatures. This feature helps to check the spread of any kind of worm—known or unknown. We envision a two-layer hierarchical architecture comprising local security managers (LSMs), metropolitan security managers (MSM), and a global security manager (GSM). Local managers collect suspicious flows and hand them to metropolitan managers. Metropolitan managers then use cluster analysis to sort worms from the suspicious flows. The sorted worms are used to generate the worm signature which is relayed to the global manager and then to all the collaborating networks. A separate scheme is proposed to automatically select suitable values of the system parameters. This parameter selection procedure takes into account the current network state and the threat level of the ongoing attack. The performance of the whole system is investigated using real network traffic with traces of worms. Experimental results demonstrate that the proposed scheme is capable to accurately detect email worms during the early phase of their propagations. Copyright © 2008 John Wiley & Sons, Ltd.