Anomaly Detection in Network Traffic and Automatic Filtering
Matthew Dunlop · 2006
Detection of fast-spreading Internet worms is a problem that continues to be a burden on businesses and Internet Service Providers. In this paper we present a Simple Worm Detection scheme (SWorD). SWorD is designed as a statistical detection method for detecting and automatically filtering fast-spreading worms. SWorD is a simple two-tier counting algorithm designed to be deployed on the network edge. The first-tier is a lightweight traffic filter while the second-tier is more selective and rarely invoked. We present results using network traces from both a small and large network to demonstrate SWorD’s performance. Our results show that SWorD accurately detects over 75 % of all infected hosts within six seconds, making it an attractive solution for the worm detection problem.