Traffic characterization of the web server attacks of worm viruses

Authors:
Kihun Chong;Ha Yoon Song;Sam H. Noh
Affiliations:
School of Information and Computer Engineering, Hongik University;School of Information and Computer Engineering, Hongik University;School of Information and Computer Engineering, Hongik University
Venue:
ICCS'03 Proceedings of the 2003 international conference on Computational science: PartII
Year:
2003

Citing 7
Cited 0

Time series: theory and methods

Time series: theory and methods
Analysis, modeling and generation of self-similar VBR video traffic

SIGCOMM '94 Proceedings of the conference on Communications architectures, protocols and applications
Self-similarity through high-variability: statistical analysis of Ethernet LAN traffic at the source level

IEEE/ACM Transactions on Networking (TON)
On self-similar traffic in ATM queues: definitions, overflow probability bound, and cell delay distribution

IEEE/ACM Transactions on Networking (TON)
Self-similarity in World Wide Web traffic: evidence and possible causes

IEEE/ACM Transactions on Networking (TON)
Microsoft Internet Information Services 5.0 Documentation

Microsoft Internet Information Services 5.0 Documentation
Wavelet analysis of long-range-dependent traffic

IEEE Transactions on Information Theory

Quantified Score

Hi-index	0.01

Visualization

Abstract

With the explosive popularity of the Internet, the number of accessible web servers has proliferated as well. Subsequently, malicious attacks on these servers via viruses have become more prevalent. Due to the self-propagation and self-duplication nature of these viruses, such attacks can congest the network quickly, aggravating the already limited bandwidth available and curtail service provided by the server, eventually leading to denial of all services. The IIS, in particular, has been gravely affected by such Denial of Service (DoS) attacks. Hence, various methods to prevent such attacks from affecting the network and server have been researched and proposed. In this paper, we analyze the characteristics of worm virus attack traffics, by extracting and analyzing virus attack logs. With the use of various statistical methods, we show that worm attack patterns show self-similarity with Hurst parameter H. Our purpose is to use this characteristic in annulling the negative effects of worm attacks.