FDF: Frequency detection-based filtering of scanning worms

Byungseung Kim, Hyogon Kim, Saewoong Bahk

Research output: Contribution to journalArticlepeer-review

4 Citations (Scopus)


In this paper, we propose a simple algorithm for detecting scanning worms with high detection rate and low false positive rate. The novelty of our algorithm is inspecting the frequency characteristic of scanning worms instead of counting the number of suspicious connections or packets from a monitored network. Its low complexity allows it to be used on any network-based intrusion detection system as a real-time detection module for high-speed networks. Our algorithm need not be adjusted to network status because its parameters depend on application types, which are generally and widely used in any networks such as web and P2P services. By using real traces, we evaluate the performance of our algorithm and compare it with that of SNORT. The results confirm that our algorithm outperforms SNORT with respect to detection rate and false positive rate.

Original languageEnglish
Pages (from-to)847-857
Number of pages11
JournalComputer Communications
Issue number5
Publication statusPublished - 2009 Mar 27


  • Autocorrelation
  • Frequency characteristic
  • Intrusion detection system
  • Scanning worm

ASJC Scopus subject areas

  • Computer Networks and Communications


Dive into the research topics of 'FDF: Frequency detection-based filtering of scanning worms'. Together they form a unique fingerprint.

Cite this