Host Behaviour Based Early Detection of Worm Outbreaks in Internet Backbones.pdfVIP

Host Behaviour Based Early Detection of Worm Outbreaks in Internet Backbones † Thomas D¨ubendorfer, Bernhard Plattner Computer Engineering and Networks Laboratory (TIK) Swiss Federal Institute of Technology, Zurich {duebendorfer, plattner}@tik.ee.ethz.ch Abstract Based on the observation that hosts infected by the same worm execute the same code for scanning and transferring We propose a novel near real-time method for early exploit and worm code, we assume that during a worm detection of worm outbreaks in high-speed Internet back- outbreak the network behaviour of many hosts will sud- bones. Our method attributes several behavioural proper- denly change in a similar way. In this paper, we propose ties to individual hosts like ratio of outgoing to incoming a novel near real-time method for early detection of worm traffic, responsiveness and number of connections. These outbreaks in high-speed Internet backbones. By analysing properties are used to group hosts into distinct behaviour backbone traffic at flow-level, we can attribute various be- classes. We use flow-level (Cisco NetFlow) information ex- havioural properties to hosts like ratio of outgoing to in- ported by the border routers of a Swiss Internet backbone coming traffic, responsiveness and number of connections, provider (AS559/SWITCH). By tracking the cardinality of which all are strongly influenced by