Title :
Adaptive sequential hypothesis testing for accurate detection of scanning worms
Author :
Lee, Tsern-Huei ; Lee, Sung-Yen
Author_Institution :
Dept. of Commun. Eng., Nat. Chiao Tung Univ., Hsinchu, Taiwan
Abstract :
Early detection techniques of scanning worms are based on simple observations of high port/address scanning rates of malicious hosts. Such approaches are not able to detect stealthy scanners and can be easily evaded once the threshold of scanning rate for generating alerts is known to the attackers. To overcome this problem, sequential hypothesis testing was developed as an alternative detection technique. It was found that the technique based on sequential hypothesis testing can detect scanning worms faster than those based on scanning rates in the sense that it needs fewer observations for the outcomes of connection attempts. However, the performance of the detection technique based on sequential hypothesis testing is sensitive to the probabilities of success for the first-contact connection attempts sent by benign and malicious hosts. The false positive and false negative probabilities could be much larger than the desired values if these probabilities are not known. In this paper, we present a simple adaptive algorithm which provides accurate estimates of these probabilities. Numerical results show that the proposed adaptive estimation algorithm is an important enhancement of sequential hypothesis testing because it makes the technique robust for detection of scanning worms.
Keywords :
invasive software; probability; false negative probability; false positive probability; scanning worms detection; sequential hypothesis testing; Adaptive estimation; Adaptive systems; Computer worms; Internet; National security; Pattern matching; Protocols; Robustness; Sequential analysis; Testing; Adaptive; Network Security; Sequential Hypothesis Testing;
Conference_Titel :
TENCON 2009 - 2009 IEEE Region 10 Conference
Conference_Location :
Singapore
Print_ISBN :
978-1-4244-4546-2
Electronic_ISBN :
978-1-4244-4547-9
DOI :
10.1109/TENCON.2009.5395958