A Study of Internet Worms Detection System in Distributed Networks

摘要

We propose a collaborative approach to detect worms early and efficiently. We envision a three layer hierarchical architecture and detect worms in two steps. The first step involves the collection of flows which show properties similar to those of worms. In the second step, clustering is used to detect genuine worms from the pool of these suspicious flows. We then propose a scheme which automatically generates the worm signature from the detected worm flows. This paper presents also a scheme to automatically select best suitable parametric values when this system is to be implemented online. We evaluate our schemes through experiments and present the results.