An Improved Traditional Worm Attack Pattern

Yusof, R. and Selamat, S. R. and Sahib, S. and Mas'ud, Z. and Abdollah, M. F. and Ramly, M. (2010) An Improved Traditional Worm Attack Pattern. International Symposium on Information Technology 2010. pp. 1067-1072. ISSN 978-1-4244-6716-7

Text ITSO6_T7_2-IEEE_published.pdf - Published Version Restricted to Registered users only Download (616kB) | Request a copy

Abstract

The significant threats of traditional worms such as Blaster, Sasser, Code Red and Slammer are still continuing due to their hasty spreading nature on the internet. The worms attack pattern from three different scenarios have been extracted from various logs at different OSI layers such as victim logs, attacker logs and IDS alert log. These worms attack pattern are further analyzed to form the general worms’attack pattern which describes the process of worms’ infection. This paper proposes a general attack pattern for worm in three different perspectives which is attacker, victim and victim/attacker or multi-step attack using only Blaster variant. Thus, the general attack pattern can be extended into research areas in alert correlation and computer forensic investigation.

Item Type:	Article
Uncontrolled Keywords:	worm attack pattern, log, blaster attack
Subjects:	Q Science > Q Science (General)
Divisions:	Faculty of Information and Communication Technology > Department of System and Computer Communication
Depositing User:	Dr. Robiah Yusof
Date Deposited:	05 Aug 2011 04:39
Last Modified:	19 Sep 2021 17:32
URI:	http://eprints.utem.edu.my/id/eprint/73
Statistic Details:	View Download Statistic

Actions (login required)

View Item