Network Worm Detection using Markov's and Cantelli's Inequalities

Mowbray, Miranda

HP Development Company

关键词: network worms;    anomaly detection;   

RP-ID  :  HPL-2009-162

学科分类：计算机科学（综合）

美国|英语

来源: HP Labs

【 摘 要 】

This paper presents a method of detecting network worms, which makes use of Markov's and Cantelli's statistical inequalities. This method is compared with a detection method based on one used in a commercial security product, using a data set consisting of over 3 million packets sampled from an enterprise network. The Markov-Cantelli detection method produces considerably fewer false alarms than the comparison method.