Fast Detection of Scanning Worm Infections

Stuart Schechter, Jaeyeon Jung, Arthur W. Berger
7th International Symposium on Recent Advances in Intrusion Detection (RAID), French Riviera, France, September 2004

Worm detection and response systems must act quickly to identify and quarantine scanning worms, as when left unchecked such worms have been able to infect the majority of vulnerable hosts on the Internet in a matter of minutes. We present a hybrid approach to detecting scanning worms that integrates significant improvements we have made to two existing techniques: sequential hypothesis testing and connection rate limiting. Our results show that this two-pronged approach successfully restricts the number of scans that a worm can complete, is highly e®ective, and has a low false alarm rate.

[PDF (247KB)]

Bibtex Entry:

@inproceedings{schechter2004detection,
   author =       "Stuart Schechter and Jaeyeon Jung and Arthur W. Berger",
   title =        "{Fast Detection of Scanning Worm Infections}",
   booktitle =    {7th International Symposium on Recent Advances in Intrusion Detection (RAID)},
   year =         {2004},
   month =        {September},
   address =      {French Riviera, France}
}