A new approach for early detection of Internet worms based on connection degree

In recent years, Internet-scale worm incidents occurred many times. People wonder at the speediness of the worm spread and the severe damage to the Internet. So people began to find methods to detect worms as quickly as possible. The paper first describes a worm behavior and propagation model. And then based on it, a new approach for early detection of Internet worms is proposed. This approach determines whether a worm incident has occurred by the change of the computers´ connection degree. The approach is proved to be effective on early detection of unknown worms by experiments.