Abstract:Internet is perhaps the most complex man-made system. Its complexity makes internet security a very hard problem which attracts a lot of research interests. Recent large-scale and fast spreading internet worms led to researches in automated containment against self-propagating worms and early worm detection is widely believed as the essential choke point of worm containment. In this paper, two new concepts, flow intensity and flow distribution intensity, are proposed to capture fundamental characteristics of network traffic. Although raw network traffics are non-stable, we find that the calculated flow intensity and flow distribution intensity are stable processes with non-zero means. We also find that the abnormal network behavior, e.g. occurrences of worms, will lead to significant changes of the stable process's mean and variance. EWMA (Exponential Weighted Moving Average) control charts are applied to the detection of the change point and in turn the detection of early worm propagation. The extensive experimental results show that our method detects early worm propagation in local networks both quickly and accurately.

Worm detection technology research of net-flow dynamic critical line established based on statistical analytic method

Worm Intrusion Alarm Modeling Based on Network Traffic Character

Research of Internet Worm Infection Probability Estimation Based on Comprehensive Analysis of Net-Flow and Packets

Design and Implementation of Network Worm Detection System for Internal Network

Research and Development of Worm Detection Technologies

Network Traffic Flow Analysis And Its Application In Early Detection Of Internet Worms

Research of Characteristics of Worm Traffic

Stratified Analysis of Network Flows and Its Application to Early Detection of Internet Worms

The multi-fractal nature of worm and normal traffic at individual source level

Worm Detection in Large Scale Network by Traffic

Detecting Randomly Scanning Worms Based on Heavy-Tailed Property

Adaptive method for monitoring network and early detection of internet worms

A New Approach to Automatically Detect Worms

Early Warning of Active Worms Based on Multi-Similarity

Research on Worm Epidemics and Visualization in High-Speed Links

The analysis of worm non-linear propagation model and the design of worm distributed detection technology

Network Worms Detecting System Based on Failed Connections Analysis

Fast Detection of Worm Infection for Large-Scale Networks

The research of worm distributed detection technology based on network security.

Study on Event-Sequence Based Worm Behavior Analysis in Internet

Detection Algorithm of Internet Worm Eruption and Its Application