Abstract

In this paper, we present DEWP, a router-based system designed to automatically detect and quarantine Internet worm propagation. DEWP detects worm probing traffic by matching destination port numbers between incoming and outgoing connections. This approach does not require knowledge of worm packet contents or profiles of normal traffic conditions; it can automatically detect and suppress worms due to their unusual traffic patterns. We describe how DEWP works and evaluate its effectiveness. We study the speed of detection and vulnerable host protection relative to factors including worm scanning techniques, DEWP deployment coverage and detection interval. We also investigate false detections with network trace playback. Through simulations, we show that DEWP detects worm propagation within about 4 seconds. By blocking worm probing traffic automatically, DEWP can automatically protect more than 99% hosts from being infected by random-scanning worms.

Date

2004

Authors

Xuan Chen, John Heidemann

Journal

Technical Report ISI-TR-2004-585