Detecting stealthy spreaders using online outdegree histograms

Yan Gao*, Yao Zhao, Robert Schweller, Shobha Venkataraman, Yan Chen, Dawn Song, Ming-Yang Kao

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contribution

12 Scopus citations

Abstract

We consider the problem of detecting the presence of a sufficiently large number of hosts that connect to more than a certain number of unique destinations within a given time window, over high-speed networks. We call such hosts stealthy spreaders. In practice, stealthy spreaders can be symptomatic of botnet scans or moderate worm propagation. Previous techniques have focused on detecting sources with an extremely large outdegree. However, such techniques will fail to detect spreaders such as bot scans in which each scanning host will scan only a moderate, fixed number of destinations. In contrast, our scheme maintains a small, fixed size memory usage, and is still able to detect stealthy spreader scenarios by approximating outdegree histograms from continuous traffic. To the best of our knowledge, we are the first to study the efficient outdegree histogram estimation and stealthy spreader detection problems. Evaluation based on real Internet traffic and botnet scan events show that our scheme is highly accurate and can operate online.

Original languageEnglish (US)
Title of host publication2007 Fifteenth IEEE International Workshop on Quality of Service, IWQoS 2007
Pages145-153
Number of pages9
DOIs
StatePublished - Oct 1 2007
Event2007 Fifteenth IEEE International Workshop on Quality of Service, IWQoS 2007 - Evanston, IL, United States
Duration: Jun 21 2007Jun 22 2007

Publication series

NameIEEE International Workshop on Quality of Service, IWQoS
ISSN (Print)1548-615X

Other

Other2007 Fifteenth IEEE International Workshop on Quality of Service, IWQoS 2007
CountryUnited States
CityEvanston, IL
Period6/21/076/22/07

ASJC Scopus subject areas

  • Electrical and Electronic Engineering

Fingerprint Dive into the research topics of 'Detecting stealthy spreaders using online outdegree histograms'. Together they form a unique fingerprint.

  • Cite this

    Gao, Y., Zhao, Y., Schweller, R., Venkataraman, S., Chen, Y., Song, D., & Kao, M-Y. (2007). Detecting stealthy spreaders using online outdegree histograms. In 2007 Fifteenth IEEE International Workshop on Quality of Service, IWQoS 2007 (pp. 145-153). [4262465] (IEEE International Workshop on Quality of Service, IWQoS). https://doi.org/10.1109/IWQOS.2007.376561