W-Aegis: A Propagation Behavior Based Worm Detection Model for Local Networks

摘要：

This paper presents a new approach to detect unknown worms on local networks. We propose a worm detection model based on propagation behavior of unknown worms within an intranet. The model firstly describes propagation behavior with a binary model vector structure. Then, it uses three-tier security filters to detect unknown worms. In contrast to traditional research which only focuses on how to detect the scanning behavior, the binary model vector also concerns the response behavior of the worm host. Comparison results show that it can remarkably improve the integrality of description of unknown wormspropagation behavior. Experimental results indicate that it is more accurately and efficiently in detecting local-network-wormintrusion than traditional schemes.

关键词： worm propagation behavior detection local network

作者: Zhanyong TANG Rui QI Dingyi FANG Yangxia LUO

作者单位: College of information science and technology Northwest University Xian,P.R.China Dep.Information University of Finance & Economics Xian,P.R.China

会议类型: 国际会议

会议名称: The Fifth International Conference on Information Assurance and Security(第五届信息保障与安全国际会议)

会议地点: 西安

会议语种:英文

页码: 158-162

在线出版日期: 2009-08-18（万方平台首次上网日期，不代表论文的发表时间）