Abstract
From the appearance of CodeRed and SQL Slammer worm, we have learned that the early detection of worm epidemics is important to reduce the damage caused by their outbreak. One prominent characteristic of Internet worms is to choose next targets randomly by using a random generator. In this paper, we propose a new worm detection mechanism by checking the random distribution of destination addresses. Our mechanism generates the traffic matrix and checks the value of rank of it to detect the spreading of Internet worms. From the fact that a random binary matrix holds a high value of rank, ADUR (Anomaly Detection Using Randomness check) is proposed for detecting unknown worms based on the rank of the traffic matrix. From the experiments on various environments, we show that the ADUR mechanism effectively detects the spread of new worms in an early stage, even when there is only one host infected in a monitoring network.
This work was supported in part by the ITRC program of the Korea Ministry of Information & Communications under the grant IITA-2005-(C1090-0502-0020) and the BK21 program of the Korea Ministry of Education.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Russell, R., Machie, A.: CodeRed II worm, Tech. Rep., Incident Analysis, Security Focus (August 2001)
Machie, A., Roculan, J., Russell, R., Velsen, M.V.: Nimda worm analysis, Tech. Rep., Incident Analysis, SecurityFocus (September 2001)
CERT/CC: CERT Advisory CA-2001-26 Nimda Worm (September 2001), http://www.cert.org/advisory/CA-2001-26.html
Song, D., Malan, R., Stone, R.: A snapshot of global Internet worm activity, Tech. Rep., Arbor Network (November 2001)
Park, H., Lee, H.: Evaluation of malicious codes, Tech. Rep., IIRTIRC (2004)
Zou, C.C., Gao, L., Gong, W., Towsley, D.: Monitoring and early warning for Internet worms. In: Proc. of ACM CCS (October 2003)
Wu, J., Vangala, S., Gao, L., Kwiat, K.: An efficient architecture and algorithm for detecting worms with various scan techniques. In: Proc. of NDSS (February 2004)
Berk, V.H., Gray, R.S., Bakos, G.: Flowscan: Using sensor networks and data fusion for early detection of active worms. SPIE AeroSense 5071, 92–104 (2003)
Sraniford, S., Paxson, V., Weaver, N.: How to own the Internet in your spare time. In: The 11th USENIX Security Symposium (Security 2002) (August 2002)
Weaver, N.: Warhol worms: The potential for very fast Internet plaques, http://www.cs.berkely.edu/~nweaver/warhol.html
Eichin, M., Rochlis, J.: With microscope and tweezers: An analysis of the Internet virus of November 1988. In: IEEE Symposium on Security and Privacy (1989)
Zou, C.C., Gong, W., Towsley, D.: CodeRed worm propagation modeling and analysis. In: Proc. of ACM CCS (November 2002)
Machie, A., Roculan, J., Russell, R., Velzen, M.V.: Nimda worm analysis, Tech. Rep., Incident Analysis, SecurityFocus (September 2001)
Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S., Weaver, N.: Inside the slammer worm. IEEE Magazine of Security and Privacy, 33–39 (July/August 2003)
Chen, Z., Gao, L., Kwiat, K.: Modeling the spread of active worms. In: IEEE INFOCOM (2003)
Anton, H.: Elementary linear algebra, 7th edn. John Wiley & Sons, Inc., Chichester (1994)
Marsaglia, G., Tsay, L.H.: Matrices and the structure of random number sequences. Linear algebra and its applications 67, 147–156 (1985)
Marsaglia, G.: DIEHARD: a battery of tests of randomness, http://stat.fsu.edu/~geo/diehard.html
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2006 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Park, H., Lee, H. (2006). Detecting Unknown Worms Using Randomness Check. In: Chong, I., Kawahara, K. (eds) Information Networking. Advances in Data Communications and Wireless Networks. ICOIN 2006. Lecture Notes in Computer Science, vol 3961. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11919568_77
Download citation
DOI: https://doi.org/10.1007/11919568_77
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-48563-6
Online ISBN: 978-3-540-48564-3
eBook Packages: Computer ScienceComputer Science (R0)