Correlation based analysis of spreading Codered worms

The spreading worms have greatly affected the network infrastructure security. After the CodeRed, there have been many new worms reported. To take countermeasure against the spreading worms, in this paper, a correlation based method is proposed and applied in the analysis. Results indicate that the spreading worms could cause dramatic changes in the flow size distribution. This method provides new insight into the worm detection and traffic anomaly discovery.