Geometry-based Detection Of

While traditional Internet worms take hours or days to infect a high percentage of vulnerable hosts, a flash worm takes seconds. Because of the rapid rate at which flash worms spread, existing worm defense mechanisms cannot respond fast enough to detect and stop a flash worm infection. In this project, we propose a geometric-based detection mechanism that can detect the spread of flash worms in a short period of time without human intervention. We attempt to detect network traffic patterns that are indicative of a flash worm attack in progress. We have tested our approach on simulated flash worm traffic using more than 10,000 nodes. In addition to testing on flash worm traffic, we also tested our method on realistic Internet traffic to estimate the false alarm rate. In order to efficiently analyze a large quantity of network traffic, we implemented an application that converts network traffic data into a graphical form. Using this application the analysis is done graphically with flash worm attacks appearing as tree structures.