Detecting Unknown Worms Using Randomness Check

  • Hyundo Park
  • Heejo Lee
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3961)

Abstract

From the appearance of CodeRed and SQL Slammer worm, we have learned that the early detection of worm epidemics is important to reduce the damage caused by their outbreak. One prominent characteristic of Internet worms is to choose next targets randomly by using a random generator. In this paper, we propose a new worm detection mechanism by checking the random distribution of destination addresses. Our mechanism generates the traffic matrix and checks the value of rank of it to detect the spreading of Internet worms. From the fact that a random binary matrix holds a high value of rank, ADUR (Anomaly Detection Using Randomness check) is proposed for detecting unknown worms based on the rank of the traffic matrix. From the experiments on various environments, we show that the ADUR mechanism effectively detects the spread of new worms in an early stage, even when there is only one host infected in a monitoring network.

Keywords

Anomaly Detection Infected Host Malicious Code Destination Address Worm Propagation 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Russell, R., Machie, A.: CodeRed II worm, Tech. Rep., Incident Analysis, Security Focus (August 2001)Google Scholar
  2. 2.
    Machie, A., Roculan, J., Russell, R., Velsen, M.V.: Nimda worm analysis, Tech. Rep., Incident Analysis, SecurityFocus (September 2001)Google Scholar
  3. 3.
    CERT/CC: CERT Advisory CA-2001-26 Nimda Worm (September 2001), http://www.cert.org/advisory/CA-2001-26.html
  4. 4.
    Song, D., Malan, R., Stone, R.: A snapshot of global Internet worm activity, Tech. Rep., Arbor Network (November 2001)Google Scholar
  5. 5.
    Park, H., Lee, H.: Evaluation of malicious codes, Tech. Rep., IIRTIRC (2004)Google Scholar
  6. 6.
    Zou, C.C., Gao, L., Gong, W., Towsley, D.: Monitoring and early warning for Internet worms. In: Proc. of ACM CCS (October 2003)Google Scholar
  7. 7.
    Wu, J., Vangala, S., Gao, L., Kwiat, K.: An efficient architecture and algorithm for detecting worms with various scan techniques. In: Proc. of NDSS (February 2004)Google Scholar
  8. 8.
    Berk, V.H., Gray, R.S., Bakos, G.: Flowscan: Using sensor networks and data fusion for early detection of active worms. SPIE AeroSense 5071, 92–104 (2003)CrossRefGoogle Scholar
  9. 9.
    Sraniford, S., Paxson, V., Weaver, N.: How to own the Internet in your spare time. In: The 11th USENIX Security Symposium (Security 2002) (August 2002)Google Scholar
  10. 10.
    Weaver, N.: Warhol worms: The potential for very fast Internet plaques, http://www.cs.berkely.edu/~nweaver/warhol.html
  11. 11.
    Eichin, M., Rochlis, J.: With microscope and tweezers: An analysis of the Internet virus of November 1988. In: IEEE Symposium on Security and Privacy (1989)Google Scholar
  12. 12.
    Zou, C.C., Gong, W., Towsley, D.: CodeRed worm propagation modeling and analysis. In: Proc. of ACM CCS (November 2002)Google Scholar
  13. 13.
    Machie, A., Roculan, J., Russell, R., Velzen, M.V.: Nimda worm analysis, Tech. Rep., Incident Analysis, SecurityFocus (September 2001)Google Scholar
  14. 14.
    Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S., Weaver, N.: Inside the slammer worm. IEEE Magazine of Security and Privacy, 33–39 (July/August 2003)Google Scholar
  15. 15.
    Chen, Z., Gao, L., Kwiat, K.: Modeling the spread of active worms. In: IEEE INFOCOM (2003)Google Scholar
  16. 16.
    Anton, H.: Elementary linear algebra, 7th edn. John Wiley & Sons, Inc., Chichester (1994)MATHGoogle Scholar
  17. 17.
    Marsaglia, G., Tsay, L.H.: Matrices and the structure of random number sequences. Linear algebra and its applications 67, 147–156 (1985)MATHCrossRefMathSciNetGoogle Scholar
  18. 18.
    Marsaglia, G.: DIEHARD: a battery of tests of randomness, http://stat.fsu.edu/~geo/diehard.html

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Hyundo Park
    • 1
  • Heejo Lee
    • 1
  1. 1.Korea UniversitySeoulSouth Korea

Personalised recommendations