The limits of global scanning worm detectors in the presence of background noise
David W. Richardson, Steven D. Gribble, Edward D. Lazowska · 2005
Internet worms cause billions of dollars in damage each year. To combat them, researchers have been exploring global worm detection systems to spot a new random scanning worm outbreak quickly. These systems passively listen for worm probes on unused IP addresses, looking for anomalous increases in probe tra#c to distinguish the emergence of a new worm from background Internet noise. In this