A traffic signature-based algorithm for detecting scanning internet worms. | [International Journal of Communication Networks and Information Security • 2009]

Author(s):

1. Mohammad M. Rasheed: Graduate Department of Computer Science, College of Arts and Sciences, Universiti Utara Malaysia 06010 UUM Sintok, Malaysia

2. Osman Ghazali: Graduate Department of Computer Science, College of Arts and Sciences, Universiti Utara Malaysia 06010 UUM Sintok, Malaysia

3. Md Norwawi: Graduate Department of Computer Science, College of Arts and Sciences, Universiti Utara Malaysia 06010 UUM Sintok, Malaysia

4. Mohammed M. Kadhum: Graduate Department of Computer Science, College of Arts and Sciences, Universiti Utara Malaysia 06010 UUM Sintok, Malaysia

Abstract:

Internet worms that spread autonomously from one host to another cause major problem in today’s networks. On 25th January 2003, “Slammer” was released into the internet and after ten minutes the worm infected more than 90% of vulnerable hosts. Worms cause damage to the network by consuming its resources such as bandwidth. In this paper, the authors propose a method for detecting traffic signature for unknown internet worm. The proposed method has two algorithms. The first part is an Intelligent Failure Connection Algorithm (IFCA) using Artificial Immune System; IFCA is concerned with detecting the internet worm and stealthy worm. In order to reduce the number of false alarm, the impact of normal network activities is involved but TCP failure and ICMP unreachable connection on same IP address are not calculated because the internet worm strategic attack on the different IP address. The second algorithm Traffic Signature Algorithm(TSA) is concerned with capturing traffic signature of the scanning internet worm. In this paper, the authors show that the proposed method can detect traffic signature for MSBlaster worm.

Page(s): 24-30

DOI: DOI not available

Published: Journal: International Journal of Communication Networks and Information Security, Volume: 1, Issue: 3, Year: 2009

Keywords:

Keywords are not available for this article.

References:

References are not available for this document.

Citations

Citations are not available for this document.

Citations

Downloads

Views