Worm Detection at Network Endpoints Using Information-Theoretic Traffic Perturbations
Khayam, S.A.
Radha, H.
Loguinov, D.
NUST Inst. of IT, Nat. Univ. of Sci. & Tech., Rawalpindi;
This paper appears in: Communications, 2008. ICC '08. IEEE International Conference on
Publication Date: 19-23 May 2008
On page(s): 1561-1565
Location: Beijing,
ISBN: 978-1-4244-2075-9
INSPEC Accession Number: 10041365
Digital Object Identifier: 10.1109/ICC.2008.302
Current Version Published: 2008-05-30
Abstract
In this paper, we propose an endpoint-based anomaly detection scheme that detects computer worms by comparing the current traffic patterns of each host to the corresponding benign traffic profile of the host. To detect deviations in the traffic patterns, we employ the information-theoretic Kullback-Leibler (K-L) divergence measure which estimates the distance between the distribution of source/destination ports engaged in current communication and that observed in the legitimate host traffic collected earlier. We use a small subset of traces obtained from endpoints in home, university, and office environments to build benign traffic profiles of studied endpoints. Endpoint traces are then infected with both real and simulated worms to examine the performance of our detection mechanism. To perform automated, real-time worm detection, we use Support Vector Machines (SVMs) that are trained using the K-L divergence values. Our results show that the proposed worm detector provides almost 100% detection with negligible false- alarm rates and significantly surpasses the accuracy of existing anomaly detectors.
Index
Terms
Available to subscribers and IEEE members.
References
Available to subscribers and IEEE members.
Citing Documents
Available to subscribers and IEEE members.
Cart
