W-Aegis: A Propagation Behavior Based Worm Detection Model for Local Networks

This paper presents a new approach to detect unknown worms on local networks. We propose a worm detection model based on propagation behavior of unknown worms within an intranet. The model firstly describes propagation behavior with a binary model vector structure. Then, it uses three-tier security filters to detect unknown worms. In contrast to traditional research which only focuses on how to detect the scanning behavior, the binary model vector also concerns the response behavior of the worm host. Comparison results show that it can remarkably improve the integrality of description of unknown wormspsila propagation behavior. Experimental results indicate that it is more accurately and efficiently in detecting local-network-worm-intrusion than traditional schemes.