Evaluation of a fast and robust worm detection algorithm

• US 9,069,962 B2
• Filed: 12/04/2013
• Issued: 06/30/2015
• Est. Priority Date: 03/31/2006
• Status: Expired due to Fees

• Current Assignee: WSOU Investments, LLC (WSOU Holdings, LLC)
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Bu, Tian, Woo, Thomas, VANDER WIEL, Scott Alan, Chen, Aiyou
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US14/096,145
• Publication Number:
  US 20140181978A1
• Time in Patent Office: 573 Days
• Field of Search: 726 22- 26
• US Class Current: 1/1
• CPC Class Codes: G06F 21/561 Virus type analysis
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method and computer product are presented for identifying Internet worm propagation based upon changes in packet arrival rates at a network connection. First, unsolicited (i.e., packets that were not requested by the receiver) traffic is separated from solicited traffic at the network connection. The unsolicited traffic arrival patterns are monitored and analyzed for any changes. Once changes in the unsolicited traffic arrival patterns are detected, the changes are mathematically analyzed to detect growth trends. The presence of growth trends that follow certain key characteristics indicate whether the changes are due to worm propagation.

Claims

1. A method of detecting worm propagation, comprising:

using a processor for

identifying unsolicited traffic within traffic in a network;

isolating the unsolicited traffic;

determining an arrival rate of unsolicited traffic based on at least

a cumulative summing value that indicates unsolicited traffic arrival and

an exponentially weighted moving average estimate of the arrival rate;

determining whether the cumulative summing value exceeds a selected threshold;

determining a local maximum of the cumulative summing value;

determining whether the cumulative summing value decreases with respect to the local maximum; and

identifying worm propagation based on the cumulative summing value increasing or remaining essentially the same with respect to the local maximum for a plurality of sequential cumulative summing values.

2. The method of claim 1, comprising resetting the cumulative summing value to a preselected value based on a downtrend in the cumulative summing value with respect to the local maximum.

3. The method of claim 1, comprising

determining whether at least the cumulative summing value indicates a large unsolicited traffic propagation rate;

and

initiating an alarm condition corresponding to worm propagation.

4. The method of claim 1, comprising identifying worm propagation based on an exponential growth rate in the unsolicited traffic arrival rate.

5. The method of claim 1, wherein the network includes a router and the unsolicited traffic is received at the router.

6. The method of claim 1, comprising identifying worm propagation based on a decrease in an inter-arrival time between unsolicited traffic packets.

7. The method of claim 6, wherein identifying worm propagation is based on the inter-arrival time having a decreasing mean over time.