A Novel Worm Detection Model Based on Host Packet Behavior Ranking

Download PDF
Open Webpage

Fengtao Xiao, Huaping Hu, Bo Liu, Xin Chen

Published: 2008, Last Modified: 08 Jan 2026OTM Conferences (2) 2008EveryoneRevisionsBibTeXCC BY-SA 4.0
Abstract: Traditional behavior-based worm detection can’t eliminate the influence of the worm-like P2P traffic effectively, as well as detect slow worms. To try to address these problems, this paper first presents a user habit model to describe the factors which influent the generation of network traffic, then a design of HPBRWD (Host Packet Behavior Ranking Based Worm detection) and some key issues about it are introduced. This paper has three contributions to the worm detection: 1) presenting a hierarchical user habit model; 2) using normal software and time profile to eliminate the worm-like P2P traffic and accelerate the detection of worms; 3) presenting HPBRWD to effectively detect worms. Experiments results show that HPBRWD is effective to detect worms.