Description

This book mainly aims at detecting the origins of preferential scanning worm and reconstructing its spread path. Our goal was to obtain a probability distribution function for estimating the probability of infection for nodes when preferential scanning worm is propagating. An algorithm is also developed on the basis of this probability distribution to allow detection of worm origin and reconstruction of its propagation path. Our purpose is to employ a complementary method and Back-to-Origin modeling to perform post-mortem forensic analysis for the propagation of worm, using the gathered network data. This is carried out to overcome the weaknesses of the current approaches, especially their high storage demand and computational complexity.