Abstract:Global-scale attacks like viruses and worms are increasing in frequency, severity and sophistication, making it critical to detect outbursts at routers/gateways instead of end hosts. In this paper we leverage data streaming techniques such as the reversible sketch to obtain HiFIND, a High-speed Flow-level Intrusion Detection system. In contrast to existing intrusion detection systems, HiFIND I ) is scalable to flow-level detection on high-speed networks; 2) zs DoS resilient; 3) can distinguish SYN flooding and various port scans (mostly for worm propagation) for effective mitigation; 4 ) enables aggregate detection over multiple routers/gateways; and 5) separates anomalies to limit false positives in detection. Both theoretical analysis and evaluation with several router traces show that HiFIND achieves these properties. To the best of our knowledge, HiFIND is the first online DoS resilient flow-level intrusion detection system for high-speed networks (approximately 10s of Gigabit/second), even for the worst case trafic of 40-byte-packet streams with each packet forming a flow.

Research on Worm Epidemics and Visualization in High-Speed Links

Research of Characteristics of Worm Traffic

Worm Intrusion Alarm Modeling Based on Network Traffic Character

Research and Development of Worm Detection Technologies

Design and Implementation of Network Worm Detection System for Internal Network

Cooperation System of Worm Detection and Quarantine in Real Time

The multi-fractal nature of worm and normal traffic at individual source level

Detecting Randomly Scanning Worms Based on Heavy-Tailed Property

Worm traffic modeling for network performance analysis

An Agent-Oriented Network Worm Defense System based on Optimized Path

Intrusion Detection And Simulation For High-Speed Networks

Study on Event-Sequence Based Worm Behavior Analysis in Internet

Worm detection technology research of net-flow dynamic critical line established based on statistical analytic method

Correlation based analysis of spreading Codered worms

Detection Algorithm of Internet Worm Eruption and Its Application

Analysis of Abnormalities of Worm Traffic for Obtaining Worm Detection Vectors

Research of Internet Worm Infection Probability Estimation Based on Comprehensive Analysis of Net-Flow and Packets

A DoS Resilient Flow-level Intrusion Detection Approach for High-speed Networks

Analysis Algorithm for the Worm Network Behavior Based on Event Sequence

An Investigation on Instant Messaging Worm Based on Complex Network Theory

AntiWorm NPU-based Parallel Bloom Filters for TCP/IP Content Processing in Giga-Ethernet LAN