FDF: Frequency detection-based filtering of scanning worms

Byungseung Kim, Saewoong Bahk, Hyogon Kim

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    1 Citation (Scopus)

    Abstract

    In this paper, we propose a simple algorithm for detecting scanning worms with high detection rate and low false positive rate. The novelty of our algorithm is inspecting the frequency characteristic of scanning worms from a monitored network. Its low complexity allows it to be used on any networkbased intrusion detection system as a real time detection module for high-speed networks. Our algorithm need not be adjusted to network status because its parameters depend on application types, which are generally and widely used in any networks such as web and P2P services. By using real traces, we evaluate the performance of our algorithm and compare it with that of SNORT. The results confirm that our algorithm outperforms SNORT with respect to detection rate and false positive rate.

    Original languageEnglish
    Title of host publication2006 IEEE International Conference on Communications, ICC 2006
    PublisherInstitute of Electrical and Electronics Engineers Inc.
    Pages2124-2129
    Number of pages6
    ISBN (Print)1424403553, 9781424403554
    DOIs
    Publication statusPublished - 2006
    Event2006 IEEE International Conference on Communications, ICC 2006 - Istanbul, Turkey
    Duration: 2006 Jul 112006 Jul 15

    Publication series

    NameIEEE International Conference on Communications
    Volume5
    ISSN (Print)0536-1486

    Other

    Other2006 IEEE International Conference on Communications, ICC 2006
    Country/TerritoryTurkey
    CityIstanbul
    Period06/7/1106/7/15

    ASJC Scopus subject areas

    • Computer Networks and Communications
    • Electrical and Electronic Engineering

    Fingerprint

    Dive into the research topics of 'FDF: Frequency detection-based filtering of scanning worms'. Together they form a unique fingerprint.

    Cite this