Defending against Internet worms: a signature-based approach

Abstract— With the capability of infecting hundreds of thousands of hosts, worms represent a major threat to the Internet. The defense against Internet worms is largely an open problem. This paper attempts to answer two important questions. Can a localized defense system detect new worms that were not seen before and, moreover, capture the attack packets? How to identify polymorphic worms from the normal background traffic? We have two major contributions. The first contribution is the design of a novel double-honeypot system, which is able to automatically detect new worms and isolate the attack traffic. The second

• Type: Conference
• Year: 2005
• Where: INFOCOM
• Authors: Yong Tang, Shigang Chen
• Keywords: Communications, INFOCOM 2005, Internet Worms, Major Threat, Polymorphic Worms