Worm and attack early warning: piercing stealthy reconnaissance

The author describes some aspects of the Worminator project (http://worminator.cs.columbia.edu), a collaboration of academic institutions pursuing R&D of intelligent predictive and proactive technologies that detect, report, and defend against early preattack cyberevents; specifically network observables, that are precursors to malicious activities during a later attack stage. The project aims to measure and significantly increase the warning time for a zero-day attack (an attack against an unreported vulnerability) to give security analysts and decision makers time to take preventive steps and for automated adaptive response mechanisms to reconfigure IT infrastructures to minimize the impact and losses.