Framework for Integrated Proactive Network Worm Detection and Response

The paper considers an integrated proactive framework for defense against spreading network worms in the Internet. The framework is intended for network worm detection (by recognizing the actions on scanning of network hosts) and containment of worm spreading (by limiting and blocking the packets transmitted by infected hosts). The framework is based on application of different heuristic detection and response mechanisms, their combination and automatic dynamic adaptation according to current network conditions. The paper describes the software system for simulation and evaluation of defense mechanisms investigated against spreading network worms and the results of experiments on detection and containment of network worms.