Knowledge of the worm origin is necessary to forensic analysis, and knowledge of the initial causal flows supports diagnosis of how network defenses were breached. Fast and accurate online tracing network worm during its propagation, help to detect worm origin and the earliest infected nodes, and is essential for large-scale worm containment. This paper introduces the Accumulation Algorithm which can efficiently tracing worm origin and the initial propagation paths, and presents an improved online Accumulation Algorithm using sliding detection windows. We also analyzes and verifies their detection accuracy and containment efficacy through simulation experiments in large scale network. Results indicate that the online Accumulation Algorithm can accurately tracing worms and efficiently containing their propagation in an approximately real-time manner. © 2008 Springer Berlin Heidelberg.
CITATION STYLE
Xiang, Y., Li, Q., & Guo, D. (2008). Online accumulation: Reconstruction of worm propagation path. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) (Vol. 5245 LNCS, pp. 162–172). Springer Verlag. https://doi.org/10.1007/978-3-540-88140-7_15
Mendeley helps you to discover research relevant for your work.