Detecting unknown worms using randomness check

Hyundo Park, Heejo Lee

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    1 Citation (Scopus)


    From the appearance of CodeRed and SQL Slammer worm, we have learned that the early detection of worm epidemics is important to reduce the damage caused by their outbreak. One prominent characteristic of Internet worms is to choose next targets randomly by using a random generator. In this paper, we propose a new worm detection mechanism by checking the random distribution of destination addresses. Our mechanism generates the traffic matrix and checks the value of rank of it to detect the spreading of Internet worms. From the fact that a random binary matrix holds a high value of rank, ADUR (Anomaly Detection Using Randomness check) is proposed for detecting unknown worms based on the rank of the traffic matrix. From the experiments on various environments, we show that the ADUR mechanism effectively detects the spread of new worms in an early stage, even when there is only one host infected in a monitoring network.

    Original languageEnglish
    Title of host publicationInformation Networking
    Subtitle of host publicationAdvances in Data Communications and Wireless Networks - International Conference, ICOIN 2006. Revised Selected Papers
    PublisherSpringer Verlag
    Number of pages10
    ISBN (Print)3540485635, 9783540485636
    Publication statusPublished - 2006
    EventInternational Conference on Information Networking, ICOIN 2006 - Sendai, Japan
    Duration: 2006 Jan 162006 Jan 19

    Publication series

    NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
    Volume3961 LNCS
    ISSN (Print)0302-9743
    ISSN (Electronic)1611-3349


    OtherInternational Conference on Information Networking, ICOIN 2006

    ASJC Scopus subject areas

    • Theoretical Computer Science
    • Computer Science(all)


    Dive into the research topics of 'Detecting unknown worms using randomness check'. Together they form a unique fingerprint.

    Cite this