DMCA
Fast Detection of Scanning Worm Infections (2004)
Cached
Download Links
- [www.eecs.harvard.edu]
- [inat.lcs.mit.edu]
- [nms.lcs.mit.edu]
- [eecs.harvard.edu]
- [nms.csail.mit.edu]
- [wind.lcs.mit.edu]
- [eecs.harvard.edu]
- DBLP
Other Repositories/Bibliography
| Venue: | IN PROCEEDINGS OF THE 7 TH INTERNATIONAL SYMPOSIUM ON RECENT ADVANCES IN INTRUSION DETECTION (RAID |
| Citations: | 94 - 3 self |
BibTeX
@INPROCEEDINGS{Schechter04fastdetection,
author = {Stuart E. Schechter and Jaeyeon Jung and Arthur W. Berger},
title = {Fast Detection of Scanning Worm Infections},
booktitle = {IN PROCEEDINGS OF THE 7 TH INTERNATIONAL SYMPOSIUM ON RECENT ADVANCES IN INTRUSION DETECTION (RAID},
year = {2004},
pages = {59--81},
publisher = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Worm detection and response systems must act quickly to identify and quarantine scanning worms, as when left unchecked such worms have been able to infect the majority of vulnerable hosts on the Internet in a matter of minutes [9]. We present a hybrid approach to detecting scanning worms that integrates significant improvements we have made to two existing techniques: sequential hypothesis testing and connection rate limiting. Our results show that this two-pronged approach successfully restricts the number of scans that a worm can complete, is highly e#ective, and has a low false alarm rate.
