Code red worm propagation modeling and analysis
Proceedings of the 9th ACM conference on Computer and communications security
On Detecting Camouflaging Worm
ACSAC '06 Proceedings of the 22nd Annual Computer Security Applications Conference
nicter: An Incident Analysis System Toward Binding Network Monitoring with Malware Analysis
WISTDCS '08 Proceedings of the 2008 WOMBAT Workshop on Information Security Threats Data Collection and Sharing
| Hi-index | 0.00 |
Network monitoring systems that detect and analyze malicious activities as well as counter them, are becoming increasingly important. As malwares, such as worms, viruses, and bots, can inflict significant damages on both the infrastructure and the end user, technologies for identifying such propagating malwares are in great demand. In the large-scale darknet monitoring operation, we can see that malwares have various kinds of scan patterns that involves choosing destination IP addresses. With a focus on such scan patterns, this paper proposes a novel concept of malware feature extraction and a distinct analysis method named ``SPectrum Analysis for Distinction and Extraction of malware features (SPADE).''Through several evaluations using real scan traffic, we show that SPADE has the significant advantage of recognizing the similarities and dissimilarities between the same and different types of malwares.