資源描述：
《host behaviour based early detection of worm outbreaks in internet backbones》由會(huì)員上傳分享，免費(fèi)在線閱讀，更多相關(guān)內(nèi)容在教育資源-天天文庫(kù)。
1、HostBehaviourBasedEarlyDetectionofWormOutbreaksinInternetBackbonesThomasD¨ubendorfer?,BernhardPlattnerComputerEngineeringandNetworksLaboratory(TIK)SwissFederalInstituteofTechnology,Zurich{duebendorfer,plattner}@tik.ee.ethz.chAbstractBasedontheobservationthathosts
2、infectedbythesamewormexecutethesamecodeforscanningandtransferringWeproposeanovelnearreal-timemethodforearlyexploitandwormcode,weassumethatduringawormdetectionofwormoutbreaksinhigh-speedInternetback-outbreakthenetworkbehaviourofmanyhostswillsud-bones.Ourmethodattr
3、ibutesseveralbehaviouralproper-denlychangeinasimilarway.Inthispaper,weproposetiestoindividualhostslikeratioofoutgoingtoincominganovelnearreal-timemethodforearlydetectionofwormtraf?c,responsivenessandnumberofconnections.Theseoutbreaksinhigh-speedInternetbackbones.
4、Byanalysingpropertiesareusedtogrouphostsintodistinctbehaviourbackbonetraf?cat?ow-level,wecanattributevariousbe-classes.Weuse?ow-level(CiscoNetFlow)informationex-haviouralpropertiestohostslikeratioofoutgoingtoin-portedbytheborderroutersofaSwissInternetbackbonecomi
5、ngtraf?c,responsivenessandnumberofconnections,provider(AS559/SWITCH).Bytrackingthecardinalityofwhichallarestronglyin?uencedbyawormoutbreak.eachclassovertimeandalarmingonfastincreasesandThesepropertiesareusedtogrouphostsintodistinctclassesothersigni?cantchanges,we
6、canearlyandreliablyde-accordingtotheircurrentbehaviour.Weshowthatbytrack-tectwormoutbreaks.Wesuccessfullyvalidatedourmethodingthecardinality?oftheseclassesforsigni?cantchangeswitharchived?ow-leveltracesofrecentmajorInternete-overtime,wormoutbreakeventscanreliably
7、bedetectedmailbasedwormssuchasMyDoom.AandSobig.F,andandasetofpotentiallyinfectedhostscanbeidenti?ed.fastspreadingnetworkwormslikeWittyandBlaster.OurTheoutlineofthispaperisasfollows:AfterasurveyofmethodisgenericinthesensethatitdoesnotrequireanyrelatedworkinSection
8、2andNetFlowtracesinSection3,previousknowledgeabouttheexploitsandscanningmethodwepresentinSection4ourhostbehaviourbasedwormde-usedbytheworms.Itcangiveasetofsusp
