Abstract:Internet worms are becoming a major threat to the security of today's large-scale networks. The fast spreading nature of worms calls for a worm monitoring and early detection system. In this paper, an effective algorithm for early detection of the active worms and the corresponding detection system are proposed. The detection engine is the key components to the system, and the early detection algorithm based on multi-similarity is discussed in detail, which is the core of the engine, that integrates the worms' behavior attributes with their traffic distribution and detects abnormal behavior by their similarity distribution change of some attributes. Our simulation experiments show that the system can detect the presence worms intrusion when attacks don't arouse the sharp changes of the network traffic. It can detect the worm attack ahead of its overspreading on the large-scale network.

Active worm countermeasure based on detection

Cooperation System of Worm Detection and Quarantine in Real Time

Research and Development of Worm Detection Technologies

Detection Method of Computer Worms Based on SVM

Host Based Unknown WOrm Detection Using Machine Learning

Design and Implementation of Network Worm Detection System for Internal Network

A worm behavioral approach to susceptible host detection

Worm Intrusion Alarm Modeling Based on Network Traffic Character

An Agent-Oriented Network Worm Defense System based on Optimized Path

Adaptive method for monitoring network and early detection of internet worms

Worm Attack Detection and Response

Effective Strategy of Worm Dynamic Defence and Containment

Wavelet Analysis Based Worm Attack Early Detection

ON IMPROVED STRATEGY OF ACTIVE RESTRAINT ALGORITHM FOR NETWORK WORMS

A Coordinated Worm Detection Method Based on Local Nets

A New Approach to Automatically Detect Worms

A Worm Early Detection System Based on Multi-Similarity

Sword - A Simple Worm Detection Scheme

A New Approach for Early Detection of Internet Worms Based on Connection Degree

Principle and Design of Active Defense System to Contain Internet Worm

SWorD : A S imple Wor m D etection Scheme