Active Worm Detection using ICMP Messages

Another paper on detecting worms using ICMP messages, from the same authors:

Internet worms have caused widespread damage. Knowing the connection characteristics of such a worm very early in its proliferation cycle might provide first responders an opportunity to intercept a global scale epidemic.

We are presenting a scalable framework for detecting, in near-realtime, active Internet worms on global networks, both public and private. By aggregating network error messages resulting from failed attempts at packet delivery, we are able to infer deviant connection behavior of hosts on interconnected networks. The Internet Control Message Protocol (ICMP) provides such error notification. Using a potentially unlimited number of collectors and analyzers, we identify 'blooms' of activity. The connection characteristics of these 'blooms' are then correlated to identify worm-like behavior, and an alert is raised.

Promising results have been produced with a simulated Internet worm, demonstrating that new worms can be detected within the first few minutes after release, depending on the level of participating router coverage.

Source: Designing a Framework for Active Worm Detection on Global Networks, Vincent Berk, George Bakos, Robert Morris.

Berk and Bakos also developed the worm detection using ICMP messages paper posted here in November. A similar paper, and also an interesting system for a large class of worms.