An improved traditional worm attack pattern

The significant threats of traditional worms such as Blaster, Sasser, Code Red and Slammer are still continuing due to their hasty spreading nature on the internet. The worms attack pattern from three different scenarios have been extracted from various logs at different OSI layers such as victim logs, attacker logs and IDS alert log. These worms attack pattern are further analyzed to form the general worms' attack pattern which describes the process of worms' infection. This paper proposes a general attack pattern for worm in three different perspectives which is attacker, victim and victim/attacker or multi-step attack using only Blaster variant. Thus, the general attack pattern can be extended into research areas in alert correlation and computer forensic investigation.