Host behaviour based early detection of worm outbreaks in Internet backbones

@inproceedings{citeulike:1082162, abstract = {We propose a novel near real-time method for early detection of worm outbreaks in high-speed Internet backbones. Our method attributes several behavioural properties to individual hosts like ratio of outgoing to incoming traffic, responsiveness and number of connections. These properties are used to group hosts into distinct behaviour classes. We use flow-level (Cisco Net Flow) information exported by the border routers of a Swiss Internet backbone provider (AS559/SWITCH). By tracking the cardinality of each class over time and alarming on fast increases and other significant changes, we can early and reliably detect worm outbreaks. We successfully validated our method with archived flow-level traces of recent major Internet e-mail based worms such as MyDoomA and Sobig.F, and fast spreading network worms like Witty and Blaster. Our method is generic in the sense that it does not require any previous knowledge about the exploits and scanning method used by the worms. It can give a set of suspicious hosts in near real-time that have recently and drastically changed their network behaviour and hence are highly likely to be infected.}, author = {Diibendorfer, T. and Plattner, B. }, citeulike-article-id = {1082162}, journal = {Enabling Technologies: Infrastructure for Collaborative Enterprise, 2005. 14th IEEE International Workshops on}, keywords = {backbone, detection, worm}, pages = {166--171}, posted-at = {2007-02-01 15:39:37}, priority = {2}, title = {Host behaviour based early detection of worm outbreaks in Internet backbones}, url = {http://ieeexplore.ieee.org/xpls/abs\_all.jsp?arnumber=1566204}, year = {2005} }

TY - CONF ID - citeulike:1082162 L3 - citeulike-article-id:1082162 TI - Host behaviour based early detection of worm outbreaks in Internet backbones JF - Enabling Technologies: Infrastructure for Collaborative Enterprise, 2005. 14th IEEE International Workshops on SP - 166 EP - 171 N2 - We propose a novel near real-time method for early detection of worm outbreaks in high-speed Internet backbones. Our method attributes several behavioural properties to individual hosts like ratio of outgoing to incoming traffic, responsiveness and number of connections. These properties are used to group hosts into distinct behaviour classes. We use flow-level (Cisco Net Flow) information exported by the border routers of a Swiss Internet backbone provider (AS559/SWITCH). By tracking the cardinality of each class over time and alarming on fast increases and other significant changes, we can early and reliably detect worm outbreaks. We successfully validated our method with archived flow-level traces of recent major Internet e-mail based worms such as MyDoomA and Sobig.F, and fast spreading network worms like Witty and Blaster. Our method is generic in the sense that it does not require any previous knowledge about the exploits and scanning method used by the worms. It can give a set of suspicious hosts in near real-time that have recently and drastically changed their network behaviour and hence are highly likely to be infected. KW - backbone KW - detection KW - worm AU - Diibendorfer, T AU - Plattner, B PY - 2005/// UR - http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=1566204 ER -