FDF: Frequency detection-based filtering of scanning worms

Byungseung Kim, Saewoong Bahk, Hyogon Kim

Research output: Chapter in Book/Report/Conference proceedingConference contribution

1 Citation (Scopus)

Abstract

In this paper, we propose a simple algorithm for detecting scanning worms with high detection rate and low false positive rate. The novelty of our algorithm is inspecting the frequency characteristic of scanning worms from a monitored network. Its low complexity allows it to be used on any networkbased intrusion detection system as a real time detection module for high-speed networks. Our algorithm need not be adjusted to network status because its parameters depend on application types, which are generally and widely used in any networks such as web and P2P services. By using real traces, we evaluate the performance of our algorithm and compare it with that of SNORT. The results confirm that our algorithm outperforms SNORT with respect to detection rate and false positive rate.

Original languageEnglish
Title of host publication2006 IEEE International Conference on Communications, ICC 2006
Pages2124-2129
Number of pages6
DOIs
Publication statusPublished - 2006
Event2006 IEEE International Conference on Communications, ICC 2006 - Istanbul, Turkey
Duration: 2006 Jul 112006 Jul 15

Publication series

NameIEEE International Conference on Communications
Volume5
ISSN (Print)0536-1486

Other

Other2006 IEEE International Conference on Communications, ICC 2006
CountryTurkey
CityIstanbul
Period06/7/1106/7/15

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Electrical and Electronic Engineering

Fingerprint Dive into the research topics of 'FDF: Frequency detection-based filtering of scanning worms'. Together they form a unique fingerprint.

  • Cite this

    Kim, B., Bahk, S., & Kim, H. (2006). FDF: Frequency detection-based filtering of scanning worms. In 2006 IEEE International Conference on Communications, ICC 2006 (pp. 2124-2129). [4024479] (IEEE International Conference on Communications; Vol. 5). https://doi.org/10.1109/ICC.2006.255084