Transcript
Page 1: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Fast and Robust Worm Detection Algorithm

Tian BuAiyou ChenScott Vander WielThomas Woo

bearhsu

Page 2: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Outline Introduction Algorithm Design

CUSUM Maximum Likelihood Inference of

Worm Propagation Rate Algorithm

Evaluation Conclusion

Page 3: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Requirement of worm detections

High -speed: Fast worms: making damage within minutes

Accuracy: False positives: alarm without worms False negatives: worms without alarms Avoiding both

Robustness: Working well for various worms with different

propagation characteristics

Page 4: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Introduction Motivation:

Proposing detecting methods with above requirements

Method of work: Monitoring unused IP addresses

Unsolicited traffic Using unsolicited packets as input to worm detection

algorithms

Result: Proposing a two-step algorithm

1st stage: CUSUM counting 2nd stage: Exponential detector

Page 5: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Unsolicited traffic Subnets usually has many unused IP

addresses Bell Labs use these unused addresses as

a network telescope Unsolicited packet:

Packets sent to the unused IP addresses Usage:

Arrival process of unsolicited packets Arrival of new sources that send these packets

Page 6: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Unsolicited Packets vs. Sources

Stream of all unsolicited packets “Scan” count

tt-sample stream stream of unsolicited packets from

external sources that have not been observed in the previous tt seconds

“Scanner” count

- Inter-arrival time

Page 7: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Unsolicited packets vs. sources- Inter-arrival time

Page 8: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Effect of worms

without worms Inter arrival-time

should be exponentially distributed

Poisson Distribution

Page 9: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Algorithm

Change Detection Maximum Likelihood Inference of

Worm Propagation Rate Complete Algorithm

Page 10: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Change Detection using CUSUM

Sn: CUSUM Xn: Tn – Tn-1, inter-arrival time While Sn exceeds a threshold h, stage 2 is triggered if the mean of Xn shifts from μ to something

smaller than μ−pμ at sample nw then Sn will tend to accumulate positive increments after nw and thus eventually cross the threshold h and signal a change.

Page 11: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

A fresh scanner arrival can be modeled as a non-stationary Poisson process

Considering the ‘background’ traffic and simply assuming that the worm starts at 0 (tw =0 )

Tn0: the most resent time that Si >0 (before CUSUM

signal)

Tj = Tn0+j – Tn0, inter-arrival time relative to n0

We can observe only T1, …, Tn, instead of T1, …Tn

Maximum Likelihood Inference

Page 12: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Maximum Likelihood Inference

Page 13: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Maximum Likelihood Inference

Page 14: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Maximum Likelihood Inference

Page 15: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Maximum Likelihood Inference

normal distributed with mean 0 and

variance 1 [20] under the null hypothesis r = r0

r0: maximal rate that can be ignored

Purpose of 2nd stage: testing that whether r is abnormally

large or not

Page 16: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Complete Worm Detection Algorithm

Page 17: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Estimation #1 - Slammer

Page 18: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Estimation #2 - Witty

Page 19: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Estimation #3 - Nimda

Page 20: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Estimation #4 - Blaster

Page 21: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Estimation - Result

Page 22: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Conclusion

Devised a fast and robust worm detection algorithm without any payload signatures

Applied the algorithm with REAL data to demonstrate the effectiveness

Future work next page...

Page 23: Fast and Robust Worm Detection Algorithm Tian Bu Aiyou Chen Scott Vander Wiel Thomas Woo bearhsu

Future work

Evaluate from a variety of Internet locations Reduce computational complexity Reduce false signal rate of the CUSUM

To make MLE computing invoked less frequently

Find new MLE algorithms


Top Related