From the introduction of CodeRed and Slammer worms, it has been learned that the early detection of worm epidemics is important in order to reduce the damage resulting from outbreaks. A prominent characteristic of Internet worms is the random selection of subsequent targets. In this paper, we propose a new worm detection mechanism by checking the random distribution of destination addresses in network traffic. The proposed mechanism constructs a matrix from network traffic and checks the rank of the matrix in order to detect the spreading of Internet worms. From the fact that a random binary matrix holds a high rank value, ADUR (Anomaly Detection Using Randomness check) is proposed for detecting unknown worms based on the rank of the matrix. From experiments on various environments, it is demonstrated that the ADUR mechanism effectively detects the spread of new worms in the early stages, even when there is only a single host infected in a monitoring network. Also, we show that ADUR is highly sensitive so that the worm epidemic can be detectable quickly, e.g., three times earlier than the infection of 90% vulnerable hosts.

• Moving picture

  This moving picture is constructed the description of the ADUR mechanism and evaluations of the ADUR. This file is avi format.

• Application program

  This application is the demo version of the ADUR application. This is the version that many of fuctions of ADUR are limited. If you want to go through the ADUR, download this file.
  The ADUR application is programmed based on pcap library. If your computer has not pcap library, install Winpcap first.

• H. Park and H. Lee, "Detecting Unknown Worms using Randomness Check", ICOIN, 2006
• H. Park, H. Lee and H. Kim, "Detecting Unknown Worms using Randomness Check" IEICE trans. Communication, 2007
• H. Park, H. Kim and H. Lee, "Is Early Warning to Imminent Worm Epidemic Possible?", IEEE Network Magazine, Sep. 2009.