Endpoint-Driven Intrusion Detection and Containment of Fast Spreading Worms in Enterprise Networks

Fast spreading network worms have become one of the most service-impacting threats in enterprise and ISP networks. We identify core requirements for effective detection and containment of such worms and propose a technique that uses a combination of distributed anomaly-based host intrusion detection and statistical analysis of network heuristics to detect malicious worm activity. Our proposal employs an automated collaborative network-centric worm containment approach. We experiment on a live test-bed with fast spreading worms and evaluate the effectiveness ofour method in detecting and containing such worms. We also evaluate the system´s performance when malicious worm traffic blends with benign network scanning traffic.