Detecting intra-enterprise scanning worms based on address resolution

摘要: Signature-based schemes for detecting Internet worms often fail on zero-day worms, and their ability to rapidly react new threats is typically limited by the requirement of some form human involvement formulate updated attack signatures. We propose an anomaly-based detection technique detailing a method detect propagation scanning within individual network cells, thus protecting internal networks from infection clients. Our software implementation indicates that this both accurate rapid enough enable automatic containment suppression worm cell. approach relies aggregate anomaly score, derived correlation address resolution protocol (ARP) activity attached devices. preliminary analysis prototype indicate can be used very small number scans