Behavioral Detection of Scanning Worm in Cyber Defense
Conficker worm spread in November 2008, it was targeting Microsoft Windows operating system that has once infected 15 million hosts. The worm system defense must be automatically detection. Before we defend against worm, we must get the worm strategy by analysis of worm behavior. So therefore, we propose Behavioral Scanning Worm Detection (BSWD) for detecting Internet worm behavior that uses TCP and UDP scanning attack. We selected four different worms for validation of worm behavioral detection. The BSWD corrected results detected the MSBlaster worm behavior more than 99%, the behavior of Sesser, Dabber, Protoride behavior more than 97% of correction. Our algorithm result recognizes the worms’ behavior in one minute.
KeywordsWorm detection Malware Cyber defense Network security
- 1.Dengyin, Z., Ye, W.: SIRS: internet worm propagation model and application. In: International Conference on Electrical and Control Engineering, pp. 3029–3032 (2010)Google Scholar
- 2.Turnbull, J., Lieverdink, P., Matotek, D.: Networking and Firewalls Pro Linux System Administration, pp. 175–266. Apress (2009)Google Scholar
- 6.Jamil, N., Chen, T.: A mathematical view of network-based suppressions of worm epidemics. In: IEEE International Conference on Communications, pp. 932–936 (2009)Google Scholar
- 10.Holz, T.: Learning more about attack patterns with honeypots. In: Sicherheit, pp. 30–41 (2006)Google Scholar