Simple security using flow data

Abstract

Malware attacks cause billions of dollars in economic damage worldwide yearly, and attackers are becoming smarter. We examine techniques for detecting worm propagation in a network using flow-level data. While worm exploits may be difficult to detect due to the wide range of payloads, the propagation phase of a worm is generally much easier to recognize. We examine this step and present one simple method for detecting network worms with no previously known signatures.