A distributed detection of hit-list worms

Nobutaka Kawaguchi, Hiroshi Shigeno, Kenichi Okada

Research output: Chapter in Book/Report/Conference proceedingConference contribution

1 Citation (Scopus)

Abstract

In this paper, we propose d-ACTM/VT, a network based worm detection method that effectively detects hit-list worms. To detect a kind of hit-list worms named Silent worms in a distributed manner, d-ACTM was proposed. d-ACTM detects the existence of worms by detecting tree structures composed of infection connections as edges. Some undetected infection connections, however, can divide the tree structures into small trees and degrade the detection performance. d-ACTM/VT addresses this problem by aggregating the divided trees as a tree named Virtual AC tree in a distributed manner and utilizes it for detection. Simulation result shows d-ACTM/VT reduces the number of infected hosts by 20% compared to d-ACTM.

Original languageEnglish
Title of host publicationICC 2008 - IEEE International Conference on Communications, Proceedings
Pages1566-1572
Number of pages7
DOIs
Publication statusPublished - 2008 Sep 12
EventIEEE International Conference on Communications, ICC 2008 - Beijing, China
Duration: 2008 May 192008 May 23

Publication series

NameIEEE International Conference on Communications
ISSN (Print)0536-1486

Other

OtherIEEE International Conference on Communications, ICC 2008
Country/TerritoryChina
CityBeijing
Period08/5/1908/5/23

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Electrical and Electronic Engineering

Cite this