Fast Detection of Scanning Worm Infections

By Stuart E. Schechter, Jaeyeon Jung, Arthur W. Berger. International Symposium on Recent Advances in Intrusion Detection, 2004

307 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/bec5fb628a25ae3837cc88f99c677cbf46f9176c

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Behavioral detection of malware on mobile handsets (2008, background): “For example, in less than one year, the infection of both Cabir and Commwarrior worms have been reported in more than 20 countries [31] and 0.5 1.5% of MMS traf.c in a Russian mobile network is made up of infected messages (which is already close to the fraction of malicious code in the email…”
A Survey of Malware Detection Techniques (2007, methodology): “[41] propose reverse sequential hypothesis testing as a method for detecting worms.”
Software Defined Networking Architecture, Security and Energy Efficiency: A Survey (2017, methodology): “1) Threshold Random Walk with Credit-Based (TRW-CB) Algorithm [114] considers the user to be suspicious if the probability value (i.”
The monitoring and early detection of Internet worms (2005, background): “[18][19] proposed a “threshold random walk” algorithm to quickly detect and block worm scans based on the excessive illegal scans sent out by worm-infected hosts.”
Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environments (2014, methodology): “In order to further evaluate the sFlow approach, we implemented the Threshold Random Walk with Credit Based connection rate limiting (TRW-CB) algorithm [33].”
Cyber–Physical Systems: A Perspective at the Centennial (2012, background): “There have been attacks on natural gas pipeline systems [244], trams [245], power utilities [246], and”
Very Fast Containment of Scanning Worms (2004, unknown): “In addition to Williamson’s [28, 26] and Staniford’s [21, 23] work on worm containment, Jung et al [ 10 ] have developed a similar containment technique based on TRW.”
DDoS Attack Detection and Mitigation Using SDN: Methods, Practices, and Solutions (2017, methodology): “Connection success ratio technique takes into account that the probability of successful connection is much higher for a benign host as compared to malicious host [57].”
Research Challenges for the Security of Control Systems (2008, unknown): “Unlike previous work [19, 27], we cannot use a fixed model for the attack hypothesis (this is known in statistics as a simple hypothesis testing problem) because for deception attacks, we do not know the attack sequences αk or βk that an adversary will select.”
Control: A perspective (2014, background): “There have been other less reported attacks of a natural gas pipeline system [582], a water system [198], a Supervisory Control and Data Acquisition system [605], trams [426] and power utilities [267].”
Attacks against process control systems: risk assessment, detection, and response (2011, methodology): “SPRT has been widely used in various problems in information security such as detecting portscans [55], worms [56], proxies used by spammers [57], and botnets [58].”
Revisiting Traffic Anomaly Detection Using Software Defined Networking (2011, methodology): “Similarly, the algorithms ported in this work [20,26,29,31] are simply proofs-of-concept to illustrate the flexibility and ease of anomaly detection algorithm implementation on an SDN platform.”
Mining anomalies using traffic feature distributions (2005, background): “Much of the work in anomaly detection and identiﬁcation has been restricted to point-solutions for speciﬁc types of anomalies, e.g. , portscans [14], worms [17,32], DOS attacks [11], and ﬂash crowds [12].”