Network Security White Papers
A Distributed Host-Based Worm Detection System
Overview This paper present a method for detecting large-scale worm attacks using only end-host detectors. These detectors propagate and aggregate alerts to cooperating partners to detect large-scale distributed attacks in progress. The properties of the host-based detectors may in fact be relatively poor in isolation but when taken collectively result in a high-quality distributed worm detector. A cooperative alert sharing protocol coupled with distributed sequential hypothesis testing is implemented to generate global alarms about distributed attacks. The system's response is evaluated in the presence of a variety of false alarm conditions and in the presence of an Internet worm attack. This evaluation is conducted with agents on the Emulab and DETER emulated testbeds using real operating systems and computing platforms.
| Publisher | Association for Computing Machinery | File Format | |
|---|---|---|---|
| Date Published | September 2006 | ||
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful? 5 out of 9 users found this white paper useful
White Paper RSS
Download
Register
