Detecting smart, self-propagating Internet worms

Self-propagating worms can infect millions of computers on the Internet in just several minutes. Although there are already many existing worm detectors, none of them systematically consider the countermeasures from worm authors, leaving them potentially ineffective against smart, evasive worms. We therefore revisit worm detection in this paper. We treat worm detection as an arms race, and study how to most effectively detect not only classic worms (i.e. worms that do not have the knowledge of worm detectors), but also evasive worms that know the worm detector in place, know its configurations, and can even adjust their scanning rate by observing legitimate traffic. We describe our design of a new worm detector called SWORD, conduct extensive experiments using realistic trace with different parameters of worms, and demonstrate that SWORD is superior to existing detectors for detecting both classic and evasive worms.