The Behavior-based Intrusion Detection and Response System for the Internet Worm

Abstract

With the popularization of the Internet and diversification of network service, the malicious worm is one of the major damages in network security issue currently. The worm can attack a large number of computers via network in a very short period, especially distributing damage via the network services. Those worms always enter or attack computer by backdoor or under-channel. There is no effective solution to prevent from these damages caused by worms. In this paper, we proposed a behavior-based intrusion detection and response system for the Internet worm named Lambent Anti-Worm System (LAWS). The LAWS can detect the intruded services and influenced range automatically. Besides, It can also analyze the key information of the intrusion. We can keep from the worm distribution and intrusion in advanced according to detected information. In addition to detect and prevent from the distribution of well-known malicious worms, the LAWS can also defense the future, unknown, or new malicious worms. The contribution of our system is to decrease the response time of attack and reduce the damaged range. At the same time, it also diminishes the damage and decreased the fixed cost.