DocumentCode :
3254268
Title :
Adaptive sequential hypothesis testing for accurate detection of scanning worms
Author :
Lee, Tsern-Huei ; Lee, Sung-Yen
Author_Institution :
Dept. of Commun. Eng., Nat. Chiao Tung Univ., Hsinchu, Taiwan
fYear :
2009
fDate :
23-26 Jan. 2009
Firstpage :
1
Lastpage :
6
Abstract :
Early detection techniques of scanning worms are based on simple observations of high port/address scanning rates of malicious hosts. Such approaches are not able to detect stealthy scanners and can be easily evaded once the threshold of scanning rate for generating alerts is known to the attackers. To overcome this problem, sequential hypothesis testing was developed as an alternative detection technique. It was found that the technique based on sequential hypothesis testing can detect scanning worms faster than those based on scanning rates in the sense that it needs fewer observations for the outcomes of connection attempts. However, the performance of the detection technique based on sequential hypothesis testing is sensitive to the probabilities of success for the first-contact connection attempts sent by benign and malicious hosts. The false positive and false negative probabilities could be much larger than the desired values if these probabilities are not known. In this paper, we present a simple adaptive algorithm which provides accurate estimates of these probabilities. Numerical results show that the proposed adaptive estimation algorithm is an important enhancement of sequential hypothesis testing because it makes the technique robust for detection of scanning worms.
Keywords :
invasive software; probability; false negative probability; false positive probability; scanning worms detection; sequential hypothesis testing; Adaptive estimation; Adaptive systems; Computer worms; Internet; National security; Pattern matching; Protocols; Robustness; Sequential analysis; Testing; Adaptive; Network Security; Sequential Hypothesis Testing;
fLanguage :
English
Publisher :
ieee
Conference_Titel :
TENCON 2009 - 2009 IEEE Region 10 Conference
Conference_Location :
Singapore
Print_ISBN :
978-1-4244-4546-2
Electronic_ISBN :
978-1-4244-4547-9
Type :
conf
DOI :
10.1109/TENCON.2009.5395958
Filename :
5395958
Link To Document :
بازگشت