Detecting Early Worm Propagation through Packet Matching
Xuan Chen and John Heidemann
USC/Information Sciences Institute
Citation
Xuan Chen and John Heidemann. Detecting Early Worm Propagation through Packet Matching. Technical Report ISI-TR-2004-585. USC/Information Sciences Institute. [PDF] [alt PDF]
Abstract
In this paper, we present DEWP, a router-based system designed to automatically detect and quarantine Internet worm propagation. DEWP detects worm probing traffic by matching destination port numbers between incoming and outgoing connections. This approach does not require knowledge of worm packet contents or profiles of normal traffic conditions; it can automatically detect and suppress worms due to their unusual traffic patterns. We describe how DEWP works and evaluate its performance with simulations. We study the speed of detection and the effectiveness of vulnerable host protection relative to factors including worm scanning techniques, DEWP deployment coverage and detection intervals. We also investigate false detections with network trace playback. We show that DEWP detects worm propagation within about 4 seconds. By blocking worm probing traffic automatically, DEWP can protect more than 99% hosts from random-scanning worms.Bibtex Citation
@techreport{Chen04b,
author = {Chen, Xuan and Heidemann, John},
title = {Detecting Early Worm Propagation through Packet Matching},
institution = {USC/Information Sciences Institute},
year = {2004},
sortdate = {2004-02-01},
project = {ant},
jsubject = {network_security},
number = {ISI-TR-2004-585},
month = feb,
jlocation = {johnh: pafile},
keywords = {DEWP, worm propagation, NEWS},
url = {https://ant.isi.edu/%7ejohnh/PAPERS/Chen04a.html},
pdfurl = {https://ant.isi.edu/%7ejohnh/PAPERS/Chen04a.pdf},
copyrightholder = {authors},
myorganization = {USC/Information Sciences Institute}
}