Detecting Early Worm Propagation through Packet Matching

Chen, Xuan and Heidemann, John
USC/Information Sciences Institute


Xuan Chen and John Heidemann 2004. Detecting Early Worm Propagation through Packet Matching. Technical Report ISI-TR-2004-585. USC/Information Sciences Institute. [PDF]


In this paper, we present DEWP, a router-based system designed to automatically detect and quarantine Internet worm propagation. DEWP detects worm probing traffic by matching destination port numbers between incoming and outgoing connections. This approach does not require knowledge of worm packet contents or profiles of normal traffic conditions; it can automatically detect and suppress worms due to their unusual traffic patterns. We describe how DEWP works and evaluate its performance with simulations. We study the speed of detection and the effectiveness of vulnerable host protection relative to factors including worm scanning techniques, DEWP deployment coverage and detection intervals. We also investigate false detections with network trace playback. We show that DEWP detects worm propagation within about 4 seconds. By blocking worm probing traffic automatically, DEWP can protect more than 99% hosts from random-scanning worms.


  author = {Chen, Xuan and Heidemann, John},
  title = {Detecting Early Worm Propagation through Packet Matching},
  institution = {USC/Information Sciences Institute},
  year = {2004},
  sortdate = {2004-02-01},
  project = {ant, saman, conser},
  jsubject = {network_security},
  number = {ISI-TR-2004-585},
  month = feb,
  jlocation = {johnh: pafile},
  keywords = {DEWP, worm propagation, NEWS},
  url = {},
  pdfurl = {},
  copyrightholder = {authors},
  myorganization = {USC/Information Sciences Institute}