Abstract
Conficker worm spread in November 2008, it was targeting Microsoft Windows operating system that has once infected 15 million hosts. The worm system defense must be automatically detection. Before we defend against worm, we must get the worm strategy by analysis of worm behavior. So therefore, we propose Behavioral Scanning Worm Detection (BSWD) for detecting Internet worm behavior that uses TCP and UDP scanning attack. We selected four different worms for validation of worm behavioral detection. The BSWD corrected results detected the MSBlaster worm behavior more than 99%, the behavior of Sesser, Dabber, Protoride behavior more than 97% of correction. Our algorithm result recognizes the worms’ behavior in one minute.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Dengyin, Z., Ye, W.: SIRS: internet worm propagation model and application. In: International Conference on Electrical and Control Engineering, pp. 3029–3032 (2010)
Turnbull, J., Lieverdink, P., Matotek, D.: Networking and Firewalls Pro Linux System Administration, pp. 175–266. Apress (2009)
Rozenberg, B., Gudes, E., Elovici, Y.: A distributed framework for the detection of new worm-related malware. In: Proceedings of the 1st European Conference on Intelligence and Security Informatics, pp. 179–190 (2008)
Costa, M., Crowcroft, J., Castro, M., Rowstron, A., Zhou, L., Zhang, L., Barham, P.: Vigilante: end-to-end containment of internet worms. ACM SIGOPS Operat. Syst. Rev. 39(5), 133–147 (2005)
Zaki, M., Hamouda, A.: Design of a multi agent system for worm spreading reduction. J. Intell. Inf. Syst. 35(1), 123–155 (2010)
Jamil, N., Chen, T.: A mathematical view of network-based suppressions of worm epidemics. In: IEEE International Conference on Communications, pp. 932–936 (2009)
He, H., Hu, M. Zhang, W., Zhang, H.: Fast detection of worm infection for large-scale networks. In: Advances in Machine Learning and Cybernetics, pp. 672–681 (2006)
Rasheed, M., Ghazali, O., Budiarto, R.: SYN scanning worm detection. Trends Appl. Sci. Res. 7(10), 859–871 (2012)
Rasheed, M., Ghazali, O., Budiarto, R.: Fast detection of stealth and slow scanning worms in transmission control protocol. J. Appl. Sci. 12(20), 2156–2163 (2012)
Holz, T.: Learning more about attack patterns with honeypots. In: Sicherheit, pp. 30–41 (2006)
Eugene, S.: The MSBlaster worm: going from bad to worse. Netw. Secur. 2003(10), 4–8 (2003)
Moskovitch, R., Elovici, Y., Rokach, L.: Detection of unknown computer worms based on behavioral classification of the host. Comput. Stat. Data Anal. 52(9), 4544–4566 (2008)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2019 Springer Nature Switzerland AG
About this paper
Cite this paper
Rasheed, M.M., Faaeq, M.K. (2019). Behavioral Detection of Scanning Worm in Cyber Defense. In: Arai, K., Bhatia, R., Kapoor, S. (eds) Proceedings of the Future Technologies Conference (FTC) 2018. FTC 2018. Advances in Intelligent Systems and Computing, vol 881. Springer, Cham. https://doi.org/10.1007/978-3-030-02683-7_16
Download citation
DOI: https://doi.org/10.1007/978-3-030-02683-7_16
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-02682-0
Online ISBN: 978-3-030-02683-7
eBook Packages: Intelligent Technologies and RoboticsIntelligent Technologies and Robotics (R0)