Early containment of worms using dummy addresses and connection trace back

Taro Inaba, Nobutaka Kawaguchi, Shinya Tahara, Hiroshi Shigeno, Ken Ichi Okada

Research output: Chapter in Book/Report/Conference proceedingConference contribution

1 Citation (Scopus)

Abstract

Most of existing network worms have used address scanning to find vulnerable hosts. Recently, however, worms with more effective propagation strategies have emerged. Among the worms, we focus on the worms that exploit address lists obtained from infected hosts to find other vulnerable hosts effectively. In this paper, we propose a method to detect and contain such worms that try to infect all hosts in an enterprise network. In our method, a detection system inserts some dummy addresses into the address lists of hosts in the network. Then, the system detects the existence of worms when a host tries to open a connection to a dummy address, and then traces back the connection logs to find potentially infected hosts and removes them from the network. Computer simulation results showed our method detected and contained worms with less than 1% infected hosts and less than 5% removed hosts.

Original languageEnglish
Title of host publicationThe 13th International Conference on Parallel and Distributed Systems, ICPADS
DOIs
Publication statusPublished - 2007 Dec 1
Event13th International Conference on Parallel and Distributed Systems, ICPADS - Hsinchu, Taiwan, Province of China
Duration: 2007 Dec 52007 Dec 7

Publication series

NameProceedings of the International Conference on Parallel and Distributed Systems - ICPADS
Volume1
ISSN (Print)1521-9097

Other

Other13th International Conference on Parallel and Distributed Systems, ICPADS
CountryTaiwan, Province of China
CityHsinchu
Period07/12/507/12/7

    Fingerprint

ASJC Scopus subject areas

  • Hardware and Architecture

Cite this

Inaba, T., Kawaguchi, N., Tahara, S., Shigeno, H., & Okada, K. I. (2007). Early containment of worms using dummy addresses and connection trace back. In The 13th International Conference on Parallel and Distributed Systems, ICPADS [4447717] (Proceedings of the International Conference on Parallel and Distributed Systems - ICPADS; Vol. 1). https://doi.org/10.1109/ICPADS.2007.4447717