A worm filter based on the number of unacknowledged requests

Authors:
Takeshi Okamoto
Affiliations:
Department of Network Engineering, Kanagawa Institute of Technology, Kanagawa, Japan
Venue:
KES'05 Proceedings of the 9th international conference on Knowledge-Based Intelligent Information and Engineering Systems - Volume Part II
Year:
2005

Citing 3
Cited 3

Throttling Viruses: Restricting propagation to defeat malicious mobile code

ACSAC '02 Proceedings of the 18th Annual Computer Security Applications Conference
A taxonomy of computer worms

Proceedings of the 2003 ACM workshop on Rapid malcode
Implementing and testing a virus throttle

SSYM'03 Proceedings of the 12th conference on USENIX Security Symposium - Volume 12

An artificial intelligence membrane to detect network intrusion

Artificial Life and Robotics
Towards an immunity-based anomaly detection system for network traffic

KES'06 Proceedings of the 10th international conference on Knowledge-Based Intelligent Information and Engineering Systems - Volume Part II
Towards an immunity-based anomaly detection system for network traffic

International Journal of Knowledge-based and Intelligent Engineering Systems

Quantified Score

Hi-index	0.00

Visualization

Abstract

We propose a new filter for preventing computer worms from spreading. The new worm filter limits the number of unacknowledged requests, rather than the rate of connections to new computers. Normal network traffic is analyzed to determine appropriate parameters for the worm filter. Performance evaluation showed that the worm filter stops not only high-speed worms in the wild, but also simulated slow-speed worms. Finally, the weaknesses of the worm filter is discussed.