Catching Instant Messaging Worms with Change-Point Detection Techniques

Instant messaging (IM) systems have gained a lot of popularity in recent years. The increasing number of IM users has lured malware authors to develop more worms and viruses that spread in IM networks. In response to such growing security threat to IM systems, it is imperative to develop a fast and responsive IM worm detection system. In this paper, we apply change-point detection techniques to catch two families of IM worms, one aimed at infecting all vulnerable machines as quickly as possible and the other aimed at spreading slowly in a stealthy fashion to evade detection. Experimental results demonstrate that the proposed solutions are very effective in detecting both families of IM worms.

• Type: Conference
• Year: 2008
• Where: NSDI
• Authors: Guanhua Yan, Zhen Xiao, Stephan Eidenbenz
• Keywords: Computer Networks, IM Networks, IM Worm Detection, Im Worms, NSDI 2008