Exploiting Temporal Consistency to Reduce False Positives in Host-Based, Collaborative Detection of Worms
View/ Open
(573.9Kb)
Access Status
Full text of the requested work is not available in DASH at this time ("restricted access"). For more information on restricted deposits, see our FAQ.Published Version
https://doi.org/10.1145/1179542.1179548Metadata
Show full item recordCitation
Malan, David J., and Michael D. Smith. 2006. Exploiting temporal consistency to reduce false positives in host-based, collaborative detection of worms. In Proceedings of the 4th ACM Workshop on Recurring Malcode 2006, Alexandria, Virginia : November 03, 2006, ed. Farnam Jahanian, 25-32. New York, NY: ACM PressAbstract
The speed of today’s worms demands automated detection, but the risk of false positives poses a difficult problem. In prior work, we proposed a host-based intrusion-detection system for worms that leveraged collaboration among peers to lower its risk of false positives, and we simulated this approach for a system with two peers. In this paper, we build upon that work and evaluate our ideas “in the wild.” We implement Wormboy 2.0, a prototype of our vision that allows us to quantify and compare worms’ and non-worms’ temporal consistency, similarity over time in worms’ and non-worms’ invocations of system calls. We deploy our prototype to a network of 30 hosts running Windows XP with Service Pack 2 to monitor and analyze 10,776 processes, inclusive of 511 unique non-worms (873 if we consider unique versions to be unique non-worms). We identify properties with which we can distinguish non-worms from worms 99% of the time. We find that our collaborative architecture, using patterns of system calls and simple heuristics, can detect worms running on multiple peers. And we find that collaboration among peers significantly reduces our probability of false positives because of the unlikely appearance on many peers simultaneously of non-worm processes with worm-like properties.Other Sources
http://www.cs.harvard.edu/~malan/publications.shtmlhttp://portal.acm.org/toc.cfm?id=1179542
Citable link to this page
http://nrs.harvard.edu/urn-3:HUL.InstRepos:2962663
Collections
- FAS Scholarly Articles [18256]
Contact administrator regarding this item (to report mistakes or request changes)