The EarlyBird System for Real-time Detection of Unknown Worms

摘要: Network worms are a major threat to the security of today’s Internet-connected hosts and networks. The combination unmitigated connectivity widespread software homogeneity allows exploit tremendous parallelism in propagation. Modern spread so quickly that no human-mediated reaction outbreak new worm can hope prevent epidemic. In this paper we propose an automated method for detecting based on traffic characteristics common most them: highly repetitive packet content, increasing population sources generating infections number destinations being targeted. Our generates content signatures without any human intervention. Preliminary results small network show promising results: have identified three confirmed with low percentage false positives. This gives us reason believe our could form core effective network-level detection countermeasure system capable substantially slowing down worms.