Modeling and Detection of Camouflaging Worm using IP Traceback

Active worms pose major security threats to the Internet. This is due to the ability of active worms to propagate in an automated fashion as they continuously compromise computers on the Internet. Active worms evolve during their propagation, and thus, pose great challenges to defend against them. A new class of active worms, referred to as Camouflaging Worm (C-Worm in short). The C-Worm is different from traditional worms because of its ability to intelligently manipulate its scan traffic volume over time. Thereby, the C-Worm camouflages its propagation from existing worm detection systems based on analyzing the propagation traffic generated by worms. The characteristics of the C-Worm and conduct a comprehensive comparison between its traffic and non-worm traffic (background traffic). The two types of traffic are barely distinguishable in the time domain. However, their distinction is clear in the frequency domain, due to the recurring manipulative nature of the CWorm. Motivated by observations, designed a novel spectrumbased scheme to detect the C-Worm. The Power Spectral Density (PSD) distribution of the scan traffic volume and its corresponding Spectral Flatness Measure (SFM) to distinguish the C-Worm traffic from background traffic. Using a comprehensive set of detection metrics and real-world traces as background traffic, the extensive performance evaluations on proposed spectrum-based detection scheme. The performance data clearly demonstrates that our scheme can effectively detect the C-Worm propagation. Furthermore, show the generality of spectrum-based scheme in effectively detecting not only y the C-Worm, but traditional worms as well. Keywords-DDoS, SFM, PSD, C-WORM, Networks