Advanced Search
DSpace@MIT

On the Adaptive Real-Time Detection of Fast-Propagating Network Worms

Research and Teaching Output of the MIT Community

Show simple item record

dc.contributor.advisor Hari Balakrishnan
dc.contributor.author Jung, Jaeyeon
dc.contributor.author Milito, Rodolfo A.
dc.contributor.author Paxson, Vern
dc.contributor.other Networks & Mobile Systems
dc.date.accessioned 2006-11-13T18:32:38Z
dc.date.available 2006-11-13T18:32:38Z
dc.date.issued 2006-11-10
dc.identifier.other MIT-CSAIL-TR-2006-074
dc.identifier.uri http://hdl.handle.net/1721.1/34875
dc.description.abstract We present two light-weight worm detection algorithms thatoffer significant advantages over fixed-threshold methods.The first algorithm, RBS (rate-based sequential hypothesis testing)aims at the large class of worms that attempts to quickly propagate, thusexhibiting abnormal levels of the rate at which hosts initiateconnections to new destinations. The foundation of RBS derives fromthe theory of sequential hypothesis testing, the use of which fordetecting randomly scanning hosts was first introduced by our previouswork with the TRW (Threshold Random Walk) scan detection algorithm. The sequential hypothesistesting methodology enables engineering the detectors to meet falsepositives and false negatives targets, rather than triggering whenfixed thresholds are crossed. In this sense, the detectors that weintroduce are truly adaptive.We then introduce RBS+TRW, an algorithm that combines fan-out rate (RBS)and probability of failure (TRW) of connections to new destinations.RBS+TRW provides a unified framework that at one end acts as a pure RBSand at the other end as pure TRW, and extends RBS's power in detectingworms that scan randomly selected IP addresses.
dc.format.extent 17 p.
dc.format.extent 400578 bytes
dc.format.extent 1658364 bytes
dc.format.mimetype application/pdf
dc.format.mimetype application/postscript
dc.language.iso en_US
dc.relation.ispartofseries Massachusetts Institute of Technology Computer Science and Artificial Intelligence Laboratory
dc.title On the Adaptive Real-Time Detection of Fast-Propagating Network Worms


Files in this item

Name Size Format Description
MIT-CSAIL-TR-2006 ... 391.1Kb PDF

Files in this item

Name Size Format Description
MIT-CSAIL-TR-2006 ... 1.581Mb Postscript

This item appears in the following Collection(s)

Show simple item record

MIT-Mirage