Endpoint-Driven Intrusion Detection and Containment of Fast Spreading Worms in Enterprise Networks

Fast spreading network worms have become one of the most service-impacting threats in enterprise and ISP networks. We identify core requirements for effective detection and containment of such worms and propose a technique that uses a combination of distributed anomaly-based host intrusion detection and statistical analysis of network heuristics to detect malicious worm activity. Our proposal employs an automated collaborative network-centric worm containment approach. We experiment on a live test-bed with fast spreading worms and evaluate the effectiveness ofour method in detecting and containing such worms. We also evaluate the system's performance when malicious worm traffic blends with benign network scanning traffic.