On the effectiveness of distributed worm monitoring

摘要: Distributed monitoring of unused portions the IP address space holds promise providing early and accurate detection high-profile security events, especially Internet worms. While this observation has been accepted for some time now, a systematic analysis requirements building an effective distributed infrastructure is still missing. In paper, we attempt to quantify benefits evaluate practicality approach. To do so developed new worm propagation model that relaxes earlier assumptions regarding uniformity underlying vulnerable population. This allows us how size monitored space, as well number locations monitors, impact time. We empirically effect these parameters using traffic traces from over 1.5 billion suspicious connection attempts observed by more than 1600 intrusion systems dispersed across Internet. Our results show monitors with half allocated centralized monitor can detect non-uniform scanning worms in Moreover, same four times faster. Furthermore, even partial knowledge population density be used improve placement. Exploiting information about location leads, cases, seven fast compared random deployment.