ACTM: Anomaly Connection Tree Method to detect silent worms

Nobutaka Kawaguchi, Yusuke Azuma, Shintaro Ueda, Hiroshi Shigeno, Ken Ichi Okada

研究成果: Conference contribution

6 被引用数 (Scopus)

抄録

In this paper we propose a novel worm detection method that can detect silent worms in intranet. Most existing detection methods use aggressive activities of worms as a clue for detection and are ineffective against worms that propagate silently using a list of vulnerable hosts. To detect such worms, we propose Anomaly Connection Tree Method (ACTM). ACTM uses two features present to most worms. First is that the worms's propagation behaviour is expressed as tree-like structures. Second is that the worm's selection of infection targets does not consider which hosts its infected host communicates to frequently. Then, by constructing trees that are composed of anomaly connections, ACTM detects the existence of such worms. Through the simulation results, we have shown that ACTM can detect the worms in an early stage.

本文言語English
ホスト出版物のタイトルProceedings - 20th International Conference on Advanced Information Networking and Applications
ページ901-906
ページ数6
DOI
出版ステータスPublished - 2006 11 22
イベント20th International Conference on Advanced Information Networking and Applications - Vienna, Austria
継続期間: 2006 4 182006 4 20

出版物シリーズ

名前Proceedings - International Conference on Advanced Information Networking and Applications, AINA
1
ISSN(印刷版)1550-445X

Other

Other20th International Conference on Advanced Information Networking and Applications
CountryAustria
CityVienna
Period06/4/1806/4/20

ASJC Scopus subject areas

  • Engineering(all)

フィンガープリント 「ACTM: Anomaly Connection Tree Method to detect silent worms」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル