Abstract

The effort required for detecting worm that threaten the reliability and stability of network resources is in the process of advancing, demanding increasingly sophisticated resources. A worm is a self-propagating program that infects other hosts based on a known vulnerability in network hosts. The spread of active worms does not need any human interaction. There is a growing demand for effective techniques to detect the presence of worms and to reduce the worms spread. Worms have become a major threat to the Internet due to their ability to rapidly, compromise large numbers of computers. This work presents a comparative analysis of behavioural classification of networks (BCN) and early warning system (EWS) to determine which one performs better in computer worm detection.

References

• Addison W and Lance S 2003Honeypots: Tracking Hackers.
• Berk V. H. , Gray R. S. , and Bakos G. 2003. Using sensor networks and data fusion for early detection of active worms. In Proceedings of the SPIE AeroSense,2003.
• Chen Z, Gao L, and Kwiat K 2003 Modeling the spread of active worms. In Proceedings of the IEEE INFOCOM 2003, March 2003.
• Shigang Chen, Sanjay Ranka 2004 Detecting Internet Worms at Early Stage
• John L, Richard L, Henry O, Didier C, and Brian C. 2003. The use of honeynets to detect exploited systems across large enterprise networks". In Proceedings of the 2003 IEEE Workshop on Information Assurance.
• Wu J, Vangala S, Gao L, and Kwiat K 2004. An efficient architecture and algorithm for detecting worms with various scan techniques. In Proceedings of the 11th Annual Network and Distributed System Security Symposium (NDSS'04), February 2004.
• Zou C. C. , Towsley D. ,Gong W and Cai S 2003. Routing worm: A fast, selective attack worm based on ip address information. Technical Report TR-03-CSE-06, Umass ECE Dept. , November 2003.