Reconstruction of Worm Propagation Path by Causality

Fast and accurate online tracing of network worm during its propagation is essential for worm containment and reducing the loss. Though worm is randomly spread, there exists implicit causality between adjacent infected nodes. Using this causality can help to enhance the performance of worm tracing algorithm. Bayesian Network can be a very good probability description of the current results and prior conditions. Based on the analysis of causality, we present an improved online tracing algorithm -- Bayesian Network Correlation Algorithm to acquire worm propagation path, and analyze and verify its accuracy and performance through simulation experiments. Experiment result indicates that the detection accuracy of Bayesian Network Correlation Algorithm has risen by 10% compared to our previous work, this improved algorithm is more suitable for online detection.