Detection of Active Internet Worm : Camouflaging Worm

Internet worms are truly autonomous virtual viruses, spreading across the net, breaking into computers, and replicating without human assistance and usually without human knowledge. Worms are particularly interesting technological constructs, with an intriguing mathematical structure and complexity. They fascinate because they take the digital imitation of life to another step - they autonomously search for computers, penetrate them, and replicate their intelligence to continue the process. An active worm refers to a malicious software program that propagates itself on the Internet to infect other computers. The propagation of the worm is based on exploiting vulnerabilities of computers on the Internet. The camouflaging worm, also called C- Worm, is a type of active internet worm. A C- Worm can intelligently manipulate its scan traffic volume over time. Thus a C- Worm can camouflage its propagation form existing worm detection systems based on analyzing the propagation traffic generated by worms. This paper presents a method to detect C- Worms.