An Approach towards Modeling and Detection of Camouflaging Worm using PSD Technique

Abstract

Large scale worm outbreaks are consider as a major security threat to today‟s internet. Internet worms can be classified according to the technique by which they discover new targets to infect. So, In this paper we will introduce the basic principles behind the modeling and detection of an polymorphic worm, referred to as Camouflaging-Worm(C-Worm).The C-Worm‟s most novel feature is hiding and controlling of the propagation and it‟s speed from the worm defense system. Due to the nature of self-propagation, the C-Worm use more complex mechanisms to manipulate the scan traffic volume over time in order to avoid detection. Order to defend against C-Worm, an effective way is to analyze the scan traffic volume in frequency domain. Our proposed method uses the Power Spectral Density (PSD) distribution of the scan traffic volume and its corresponding Spectral Flatness Measure (SFM) to distinguish the C-Worm traffic from non-worm traffic. Promising results have been produced with a simulated C-worm, demonstrating that all other traditional worms can be detected by our spectrum-based scheme.