Method of detecting network worms
First Claim
1. A method of detecting network worms, comprising:
- profiling connection information of a protected network to generate connection parameters and connection status values;
clustering the connection profile of the connection parameters and the connection status values to generate a plurality of clusters;
extracting cluster parameters from the generated clusters and computing attempt measures of the clusters;
determining whether any of the clusters is an anomaly cluster;
correlating the newly generated anomaly cluster with an existing cluster graph and adding it into the cluster graph if the correlation is successful or establishing a new cluster graph with the newly generated anomaly cluster if the correlation is unsuccessful, each of the cluster graph being appended with its status and a propagation measure;
determining whether a worm propagation activity is going on for cluster graphs that satisfy a specific propagation condition;
eliminating a cluster graph that does not satisfy the propagation condition within a first predetermined time; and
claiming the ending of the worm propagation activity of a cluster graph that does not have new cluster added to it within a second predetermined time.
2 Assignments
0 Petitions
Accused Products
Abstract
A method of detecting network worms include the following steps: (1) Profiling the TCP connection information collected from the protected network, quantifying the plurality of statuses contained in the TCP connection information; (2) Clustering the connection profiles to discover all the anomaly clusters that are specified by the condition composing of several adaptive thresholds; (3) Correlating the anomaly clusters to result in a new cluster graph or to extend an existing cluster graph; (4) Issuing a security incident about the worm propagation according to the propagation condition that also composes of several adaptive thresholds; and (5) Keeping and maintaining the status of the cluster graphs.
-
Citations
20 Claims
-
1. A method of detecting network worms, comprising:
-
profiling connection information of a protected network to generate connection parameters and connection status values;
clustering the connection profile of the connection parameters and the connection status values to generate a plurality of clusters;
extracting cluster parameters from the generated clusters and computing attempt measures of the clusters;
determining whether any of the clusters is an anomaly cluster;
correlating the newly generated anomaly cluster with an existing cluster graph and adding it into the cluster graph if the correlation is successful or establishing a new cluster graph with the newly generated anomaly cluster if the correlation is unsuccessful, each of the cluster graph being appended with its status and a propagation measure;
determining whether a worm propagation activity is going on for cluster graphs that satisfy a specific propagation condition;
eliminating a cluster graph that does not satisfy the propagation condition within a first predetermined time; and
claiming the ending of the worm propagation activity of a cluster graph that does not have new cluster added to it within a second predetermined time. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20)
-
Specification