ACTM: Anomaly Connection Tree Method to detect silent worms

Nobutaka Kawaguchi, Yusuke Azuma, Shintaro Ueda, Hiroshi Shigeno, Ken Ichi Okada

Research output: Chapter in Book/Report/Conference proceedingConference contribution

6 Citations (Scopus)

Abstract

In this paper we propose a novel worm detection method that can detect silent worms in intranet. Most existing detection methods use aggressive activities of worms as a clue for detection and are ineffective against worms that propagate silently using a list of vulnerable hosts. To detect such worms, we propose Anomaly Connection Tree Method (ACTM). ACTM uses two features present to most worms. First is that the worms's propagation behaviour is expressed as tree-like structures. Second is that the worm's selection of infection targets does not consider which hosts its infected host communicates to frequently. Then, by constructing trees that are composed of anomaly connections, ACTM detects the existence of such worms. Through the simulation results, we have shown that ACTM can detect the worms in an early stage.

Original languageEnglish
Title of host publicationProceedings - International Conference on Advanced Information Networking and Applications, AINA
Pages901-906
Number of pages6
Volume1
DOIs
Publication statusPublished - 2006
Event20th International Conference on Advanced Information Networking and Applications - Vienna, Austria
Duration: 2006 Apr 182006 Apr 20

Other

Other20th International Conference on Advanced Information Networking and Applications
CountryAustria
CityVienna
Period06/4/1806/4/20

Fingerprint

Intranets

ASJC Scopus subject areas

  • Engineering(all)

Cite this

Kawaguchi, N., Azuma, Y., Ueda, S., Shigeno, H., & Okada, K. I. (2006). ACTM: Anomaly Connection Tree Method to detect silent worms. In Proceedings - International Conference on Advanced Information Networking and Applications, AINA (Vol. 1, pp. 901-906). [1620301] https://doi.org/10.1109/AINA.2006.70

ACTM : Anomaly Connection Tree Method to detect silent worms. / Kawaguchi, Nobutaka; Azuma, Yusuke; Ueda, Shintaro; Shigeno, Hiroshi; Okada, Ken Ichi.

Proceedings - International Conference on Advanced Information Networking and Applications, AINA. Vol. 1 2006. p. 901-906 1620301.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Kawaguchi, N, Azuma, Y, Ueda, S, Shigeno, H & Okada, KI 2006, ACTM: Anomaly Connection Tree Method to detect silent worms. in Proceedings - International Conference on Advanced Information Networking and Applications, AINA. vol. 1, 1620301, pp. 901-906, 20th International Conference on Advanced Information Networking and Applications, Vienna, Austria, 06/4/18. https://doi.org/10.1109/AINA.2006.70
Kawaguchi N, Azuma Y, Ueda S, Shigeno H, Okada KI. ACTM: Anomaly Connection Tree Method to detect silent worms. In Proceedings - International Conference on Advanced Information Networking and Applications, AINA. Vol. 1. 2006. p. 901-906. 1620301 https://doi.org/10.1109/AINA.2006.70
Kawaguchi, Nobutaka ; Azuma, Yusuke ; Ueda, Shintaro ; Shigeno, Hiroshi ; Okada, Ken Ichi. / ACTM : Anomaly Connection Tree Method to detect silent worms. Proceedings - International Conference on Advanced Information Networking and Applications, AINA. Vol. 1 2006. pp. 901-906
@inproceedings{1013b4042c90447298d5867b6ec164c0,
title = "ACTM: Anomaly Connection Tree Method to detect silent worms",
abstract = "In this paper we propose a novel worm detection method that can detect silent worms in intranet. Most existing detection methods use aggressive activities of worms as a clue for detection and are ineffective against worms that propagate silently using a list of vulnerable hosts. To detect such worms, we propose Anomaly Connection Tree Method (ACTM). ACTM uses two features present to most worms. First is that the worms's propagation behaviour is expressed as tree-like structures. Second is that the worm's selection of infection targets does not consider which hosts its infected host communicates to frequently. Then, by constructing trees that are composed of anomaly connections, ACTM detects the existence of such worms. Through the simulation results, we have shown that ACTM can detect the worms in an early stage.",
author = "Nobutaka Kawaguchi and Yusuke Azuma and Shintaro Ueda and Hiroshi Shigeno and Okada, {Ken Ichi}",
year = "2006",
doi = "10.1109/AINA.2006.70",
language = "English",
isbn = "0769524664",
volume = "1",
pages = "901--906",
booktitle = "Proceedings - International Conference on Advanced Information Networking and Applications, AINA",

}

TY - GEN

T1 - ACTM

T2 - Anomaly Connection Tree Method to detect silent worms

AU - Kawaguchi, Nobutaka

AU - Azuma, Yusuke

AU - Ueda, Shintaro

AU - Shigeno, Hiroshi

AU - Okada, Ken Ichi

PY - 2006

Y1 - 2006

N2 - In this paper we propose a novel worm detection method that can detect silent worms in intranet. Most existing detection methods use aggressive activities of worms as a clue for detection and are ineffective against worms that propagate silently using a list of vulnerable hosts. To detect such worms, we propose Anomaly Connection Tree Method (ACTM). ACTM uses two features present to most worms. First is that the worms's propagation behaviour is expressed as tree-like structures. Second is that the worm's selection of infection targets does not consider which hosts its infected host communicates to frequently. Then, by constructing trees that are composed of anomaly connections, ACTM detects the existence of such worms. Through the simulation results, we have shown that ACTM can detect the worms in an early stage.

AB - In this paper we propose a novel worm detection method that can detect silent worms in intranet. Most existing detection methods use aggressive activities of worms as a clue for detection and are ineffective against worms that propagate silently using a list of vulnerable hosts. To detect such worms, we propose Anomaly Connection Tree Method (ACTM). ACTM uses two features present to most worms. First is that the worms's propagation behaviour is expressed as tree-like structures. Second is that the worm's selection of infection targets does not consider which hosts its infected host communicates to frequently. Then, by constructing trees that are composed of anomaly connections, ACTM detects the existence of such worms. Through the simulation results, we have shown that ACTM can detect the worms in an early stage.

UR - http://www.scopus.com/inward/record.url?scp=33751082699&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=33751082699&partnerID=8YFLogxK

U2 - 10.1109/AINA.2006.70

DO - 10.1109/AINA.2006.70

M3 - Conference contribution

AN - SCOPUS:33751082699

SN - 0769524664

SN - 9780769524665

VL - 1

SP - 901

EP - 906

BT - Proceedings - International Conference on Advanced Information Networking and Applications, AINA

ER -