DoWitcher: Effective worm detection and containment in the internet core

S. Ranjan, S. Shah, A. Nucci, M. Munafò, R. Cruz, S. Muthukrishnan

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    Abstract

    Enterprise networks are increasingly offloading the responsibility for worm detection and containment to the carrier networks. However, current approaches to the zero-day worm detection problem such as those based on content similarity of packet payloads are not scalable to the carrier link speeds (OC-48 and up-wards). In this paper, we introduce a new system, namely DoWitcher, which in contrast to previous approaches is scalable as well as able to detect the stealthiest worms that employ low-propagation rates or polymorphisms to evade detection. DoWitcher uses an incremental approach toward worm detection: First, it examines the layer-4 traffic features to discern the presence of a worm anomaly; Next, it determines a flow-filter mask that can be applied to isolate the suspect worm flows and; Finally, it enables full-packet capture of only those flows that match the mask, which are then processed by a Longest Common Subsequence algorithm to extract the worm content signature. Via a proof-of-concept implementation on a commercially available network analyzer processing raw packets from an OC-48 link, we demonstrate the capability of DoWitcher to detect low-rate worms and extract signatures for even the polymorphic worms.

    Original languageEnglish (US)
    Title of host publicationProceedings - IEEE INFOCOM 2007
    Subtitle of host publication26th IEEE International Conference on Computer Communications
    Pages2541-2545
    Number of pages5
    DOIs
    StatePublished - 2007
    EventIEEE INFOCOM 2007: 26th IEEE International Conference on Computer Communications - Anchorage, AK, United States
    Duration: May 6 2007May 12 2007

    Publication series

    NameProceedings - IEEE INFOCOM
    ISSN (Print)0743-166X

    Other

    OtherIEEE INFOCOM 2007: 26th IEEE International Conference on Computer Communications
    CountryUnited States
    CityAnchorage, AK
    Period5/6/075/12/07

    ASJC Scopus subject areas

    • Computer Science(all)
    • Electrical and Electronic Engineering

    Fingerprint Dive into the research topics of 'DoWitcher: Effective worm detection and containment in the internet core'. Together they form a unique fingerprint.

    Cite this