Behavioral Detection of Scanning Worm in Cyber Defense

  • Mohammad M. Rasheed
  • Munadil K. FaaeqEmail author
Conference paper
Part of the Advances in Intelligent Systems and Computing book series (AISC, volume 881)


Conficker worm spread in November 2008, it was targeting Microsoft Windows operating system that has once infected 15 million hosts. The worm system defense must be automatically detection. Before we defend against worm, we must get the worm strategy by analysis of worm behavior. So therefore, we propose Behavioral Scanning Worm Detection (BSWD) for detecting Internet worm behavior that uses TCP and UDP scanning attack. We selected four different worms for validation of worm behavioral detection. The BSWD corrected results detected the MSBlaster worm behavior more than 99%, the behavior of Sesser, Dabber, Protoride behavior more than 97% of correction. Our algorithm result recognizes the worms’ behavior in one minute.


Worm detection Malware Cyber defense Network security 


  1. 1.
    Dengyin, Z., Ye, W.: SIRS: internet worm propagation model and application. In: International Conference on Electrical and Control Engineering, pp. 3029–3032 (2010)Google Scholar
  2. 2.
    Turnbull, J., Lieverdink, P., Matotek, D.: Networking and Firewalls Pro Linux System Administration, pp. 175–266. Apress (2009)Google Scholar
  3. 3.
    Rozenberg, B., Gudes, E., Elovici, Y.: A distributed framework for the detection of new worm-related malware. In: Proceedings of the 1st European Conference on Intelligence and Security Informatics, pp. 179–190 (2008)CrossRefGoogle Scholar
  4. 4.
    Costa, M., Crowcroft, J., Castro, M., Rowstron, A., Zhou, L., Zhang, L., Barham, P.: Vigilante: end-to-end containment of internet worms. ACM SIGOPS Operat. Syst. Rev. 39(5), 133–147 (2005)CrossRefGoogle Scholar
  5. 5.
    Zaki, M., Hamouda, A.: Design of a multi agent system for worm spreading reduction. J. Intell. Inf. Syst. 35(1), 123–155 (2010)CrossRefGoogle Scholar
  6. 6.
    Jamil, N., Chen, T.: A mathematical view of network-based suppressions of worm epidemics. In: IEEE International Conference on Communications, pp. 932–936 (2009)Google Scholar
  7. 7.
    He, H., Hu, M. Zhang, W., Zhang, H.: Fast detection of worm infection for large-scale networks. In: Advances in Machine Learning and Cybernetics, pp. 672–681 (2006)CrossRefGoogle Scholar
  8. 8.
    Rasheed, M., Ghazali, O., Budiarto, R.: SYN scanning worm detection. Trends Appl. Sci. Res. 7(10), 859–871 (2012)CrossRefGoogle Scholar
  9. 9.
    Rasheed, M., Ghazali, O., Budiarto, R.: Fast detection of stealth and slow scanning worms in transmission control protocol. J. Appl. Sci. 12(20), 2156–2163 (2012)CrossRefGoogle Scholar
  10. 10.
    Holz, T.: Learning more about attack patterns with honeypots. In: Sicherheit, pp. 30–41 (2006)Google Scholar
  11. 11.
    Eugene, S.: The MSBlaster worm: going from bad to worse. Netw. Secur. 2003(10), 4–8 (2003)CrossRefGoogle Scholar
  12. 12.
    Moskovitch, R., Elovici, Y., Rokach, L.: Detection of unknown computer worms based on behavioral classification of the host. Comput. Stat. Data Anal. 52(9), 4544–4566 (2008)MathSciNetCrossRefGoogle Scholar

Copyright information

© Springer Nature Switzerland AG 2019

Authors and Affiliations

  1. 1.Scientific Information and Technology Transfer Center, Ministry of Science & TechnologyBaghdadIraq
  2. 2.School of Business Management, College of BusinessUniversity Utara MalaysiaChanglunMalaysia

Personalised recommendations