Community Epidemic Detection Using Time-Correlated Anomalies

Abstract. An epidemic is malicious code running on a subset of a community, a homogeneous set of instances of an application. Syzygy is an epidemic detection framework that looks for time-correlated anomalies, i.e., divergence from a model of dynamic behavior. We show mathematically and experimentally that, by leveraging the statistical properties of a large community, Syzygy is able to detect epidemics even under adverse conditions, such as when an exploit employs both mimicry and polymorphism. This work provides a mathematical basis for Syzygy, describes our particular implementation, and tests the approach with a variety of exploits and on commodity server and desktop applications to demonstrate its effectiveness.

• Type: Journal
• Year: 2010
• Where: RAID
• Authors: Adam J. Oliner, Ashutosh V. Kulkarni, Alex Aiken
• Keywords: Computer Networks, Epidemic Detection Framework, Homogeneous Set, RAID 2010, Syzygy