Detection of Non-overlapping C-Worms: A Survey

Internet worms place a major security threats to the Internet. This is due to the aptitude of worms to propagate in an automated fashion as they progressively compromise computers on the Internet. Internet worms develop gradually during their propagation and thus place great challenges to preserved against them. In this paper, we examine a new class of active worms, referred to as Non-overlapping Camouflaging Worm .The Non-overlapping C-Worm is different from traditional worms because of its ability to intelligently manipulate its scan traffic volume over time. Thereby, the Non-overlapping C-Worm camouflages its propagation from existing worm detection systems based on analyzing the propagation traffic generated by worms. We analyze characteristics of the Non-overlapping C-Worm and conduct a comprehensive comparison between its traffic and non-worm traffic (background traffic). We observe that these two types of traffic are barely distinguishable in the time domain. However, their distinction is clear in the frequency domain, due to the recurring manipulative nature of NOC worm. Motivated by our observations, we design a detection method that uses two-step procedures that combines a first stage change point detection with a second stage growth rate inference to confirm the existence of a worm. This scheme is better than the NOC-worm

Keywords-Worms , Propagation speed, Camouflage, Non-overlapping scanning.