Once a host is infected by an Internet worm, prompt action must be taken before that host does more harm to its local network and the rest of the Internet. It is therefore critical to quickly detect that a worm has infected a host. In this paper, we enhance our SWORD system to allow for the detection of infected hosts and evaluate its performance. This enhanced version of SWORD inherits the advantages of the original SWORD: it does not rely on inspecting traffic payloads to search for worm byte patterns or setting up a honeypot to lure worm traffic. Furthermore, while acting as a host-level detection system, it runs at a network's gateway and stays transparent to individual hosts. We show that our enhanced SWORD system is able to quickly and accurately detect if a host is infected by a zero-day worm. Furthermore, the detection is shown to be effective against worms of different types and speeds, including polymorphic worms
Stafford, S., J. Li, and T. Ehrenkranz.2006. On the performance of SWORD in detecting zero-day-worm-infected hosts. In Proceeding of the Symposium on Performance Evaluation of Computer and Telecommunication Systems (SPECTS) , vol. 38, no. 3, pp. 559—66, track 8 (Traffic Characterization).
2.
Staniford, S., V. Paxson, and N. Weaver.2002. How to 0wn the Internet in your spare time. In Proceedings of the USENIX Security Symposium , USENIX, Berkeley, pp. 149—167.
3.
Moore, D., V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver.2003. The spread of the Sapphire/Slammer SQL worm, http://www.caida.org/analysis/security/sapphire/ , CAIDA, La Jolla, CA, Techical Report. 2003.
4.
Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S., and N. Weaver.2003. Inside the Slammer worm. IEEE Security and Privacy4, 33—9.
5.
Weaver, N., and V. Paxson.2004. A worst-case worm. In Workshop on Economics and Information Security.
6.
Li, J., T. Ehrenkranz, G. Kuenning, and P. Reiher.2005. Simulation and analysis on the resiliency and efficiency of malnets. In Proceedings of the Symposium on Measurement, Modeling, and Simulation of Malware, Monterey, CA, June, pp. 262— 9.
7.
Moore, D., C. Shannon, G.M. Voelker, and S. Savage.2003. Internet quarantine: Requirements for containing self-propagating code. In Proceedings of the IEEE INFOCOM, IEEE Computer Society Press, Washington, pp. 1901—1910.
8.
Li, J., S. Stafford, and T. Ehrenkranz.2006. SWORD: Self-propagating worm observation and rapid detection. University of Oregon, Technical Report. CIS-TR-2006-03.
9.
Singh, S., C. Estan, G. Varghese, and S. Savage.2004. Automated worm fingerprinting. In Proceedings of the Symposium on Operating System Design and Implementation (OSDI), USENIX, Berkeley, pp. 45—60.
10.
Kim, H.-A., and B. Karp.2004. Autograph: Toward automated, distributed worm signature detection. In Proceedings of the USENIX Security Symposium, USENIX, Berkeley, pp. 271—86.
11.
Kreibich, C., and J. Crowcroft.2004. Honeycomb: Creating intrusion detection signatures using honeypots. ACM SIGCOMM ComputerCommunication Review34(1), 51—6.
12.
Nazario, J., J. Anderson, R. Wash, and C. Connelly.2003. The Future of Internet Worms. http://www.crimelabs.net/docs/worms/worm.pdf.
13.
Chen, Z., L. Gao, and K. Kwiat.2003. Modeling the spread of active worms. In Proceedings of the IEEE INFOCOM, IEEE Computer Society Press, Washington, pp. 1890—1900.
14.
Garetto, M., and W. Gong.2003. Modeling malware spreading dynamics . In Proceedings of the IEEE INFOCOM, IEEE Computer Society Press, Washington, pp. 1869—1879.
15.
Toth, T., and C. Kruegel.2002. Connection-history based anomaly detection . In Proceedings of the IEEE Workshop on Information Assurance and Security, IEEE Computer Society Press, Washington, pp. 25—30.
16.
Kruegel, C., and T. Toth.2002. Distributed pattern detection for intrusion detection. In Proceedings of the Network and Distributed System Security Symposium. Internet Society, Internet Society , Reston.
17.
Staniford-Chen, S., S. Cheung, R. Crawford, M. Dilger, J. Frank, J. Hoagland, K. Levitt, C. Wee, R. Yip, and D. Zerkle.1996. GrIDS: A graph based intrusion detection system for large networks. In P roceedings of the National Information Systems Security Conference.
18.
Twycross, J., and M.M. Williamson .2003. Implementing and testing a virus throttle. In Proceedings of the USENIX Security Symposium, USENIX, Berkeley , pp. 285—294.
19.
N. Weaver, S. Staniford, and V. Paxson, “ Very fast containment of scanning worms,” in USENIX Security Symposium. Berkeley, CA: USENIX, 2004, pp. 29—44.
20.
Moore, D., C. Shannon, and K.C. Claffy.2002. Code-Red: A case study on the spread and victims of an Internet worm. In Proceedings of the ACM Internet Measurement Workshop, ACM Press, New York, pp. 273—284.
21.
Chun, B.N., J. Lee, and H. Weatherspoon.2003. Netbait: A Distributed Worm Detection Service. http://netbait.planetlab.org. Intel Research, Berkeley, Technical Report IRB-TR-03033.
22.
Mukherjee, B., L. Heberlein, and K. Levitt.1994. Network intrusion detection . Network8(3), 26—41.
23.
Dagon, D., X. Qin, G. Gu, W. Lee, J. Grizzard, J. Levin, and H. Owen.2004. HoneyStat: Local worm detection using honeypots. In Proceedings of the Symposium on Recent Advances in Intrusion Detection, Sophia Antipolis, France, Springer, Heidelberg, pp. 39—58.
24.
Kloet, J.2005. A honeypot based worm alerting system. http://www.sans.org/rr/whitepapers/detection/1563.php.
25.
Xie, Y., V. Sekar, D.A. Maltz, M.K. Reiter, and H. Zhang.2005. Worm origin identification using random moonwalks. In Proceedings of the IEEE Symposium on Security and Privacy, IEEE Computer Society Press, Washington, DC, pp. 242—56.
26.
Zou, C.C., L. Gao, W. Gong, and D. Towsley.2003. Monitoring and early warning for Internet worms. In Proceedings of the Conference on Computer and Communications Security, ACM Press, New York, pp. 190—9.
27.
Roesch, M.1999. Snort — Lightweight intrusion detection for networks . In Proceedings of the 13th Systems Administration Conference — LISA '99, USENIX, Berkeley, pp. 229—238.
28.
WAND Network Research Group.2001. WAND WITS: Auckland-IV trace data. http://wand.cs.waikato.ac.nz/wand/wits/auck/4/, April 2001.
29.
Matsumoto, M., and T. Nishimura, 1998. Mersenne twister: A 623-dimensionally equidistributed uniform pseudorandom number generator . ACM Transactions on Modeling and Computer Simulation8(1), 3—30.
30.
Whyte, D., E. Kranakis, and P. C. van Oorschot .2005. ARP-based detection of scanning worms in an enterprise network. In Proceedings of the Annual Computer Security Applications Conference.
