Early detection of Internet worm activity by metering ICMP destination unreachable messages

George Bakos; Vincent H. Berk

doi:10.1117/12.479290

14 August 2002 Early detection of Internet worm activity by metering ICMP destination unreachable messages

George Bakos, Vincent H. Berk

Proceedings Volume 4708, Sensors, and Command, Control, Communications, and Intelligence (C3I) Technologies for Homeland Defense and Law Enforcement; (2002) https://doi.org/10.1117/12.479290
Event: AeroSense 2002, 2002, Orlando, FL, United States

Abstract

Early warning of active worm propagation over the Internet is of vital importance to first responders. Knowing an active worms characteristics very early in its propagation can significantly reduce the damage it may cause. In this paper we propose an early warning system that uses ICMP Destination Unreachable (ICMP-T3) messages to identify the random scanning behavior of worms. Participating routers across the Internet send Blind Carbon Copies of all their locally generated ICMP-T3 messages to a central collection point. There all the incoming messages are compared for similarities. Incoming messages are abstracted and patterns identified. Using the methods discussed in this paper we identify 'blooms' of activity that are a clear signature of worm propagation. Preliminary test results have shown that actively spreading worms can be identified in the first few minutes after they are launched. By using the characteristics gathered in those early stages, action can be taken and widespread damage might be avoided.

Citation Download Citation

George Bakos and Vincent H. Berk "Early detection of Internet worm activity by metering ICMP destination unreachable messages", Proc. SPIE 4708, Sensors, and Command, Control, Communications, and Intelligence (C3I) Technologies for Homeland Defense and Law Enforcement, (14 August 2002); https://doi.org/10.1117/12.479290

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available