An Effective Architecture and Algorithm for Detecting Worms with Various Scan Techniques

摘要: Since the days of Morris worm, spread malicious code has been most imminent menace to Internet. Worms use various scanning methods rapidly. that select scan destinations carefully can cause more damage than worms employing random scan. This paper analyzes techniques. We then propose a generic worm detection architecture monitors activities. and evaluate an algorithm detect using real time traces simulations. find our solution activities when only 4% vulnerable machines are infected. Our results bring insight on future battle against attacks.