Abstract — Fast spreading worms are a reality, as amply demonstrated by worms such as Slammer, which reached its peak propagation in a matter of minutes. With these kinds of fast spreading worms, the traditional approach of signature-based detection is no longer sufficient. Specifically, these worms can infect all vulnerable hosts well before a signature is available. To counter them, we must devise fast detection algorithms that can detect new worms without signatures as they first begin to appear. We present the design and evaluation of such an algorithm in this paper. The key to the algorithm is the identification of certain invariant characteristics of worm propagation. Specifically, we are able to demonstrate using real network traces how worm propagation can perturb the arrival process distribution of unsolicited packets. Our algorithm employs a novel two-step procedure that combines a first stage change point detection with a second stage growth rate inference to confirm the existence of aworm. To evaluate the algorithm, we have applied it to multi-year network traces that cover many of the major worm outbreaks in recent years, including Slammer, Witty, Nimda and Blaster. In all cases, the new algorithm is able to detect the worm within a very short time, well before significant infection has taken place. I.

The self-similarity of network traffic has been convincingly established based on detailed packet traces. This fundamental result promises the possibility of solving on-line and off-line traffic engineering problems using easily collectible coarse time-scale data, such as simple network management protocol measurements. This paper proposes a statistical model that supports predicting fine time-scale behavior of network traffic from coarse time-scale aggregate measurements. The model generalizes the commonly used fractional Gaussian noise process in two important ways: (1) it accommodates the recurring daily load patterns commonly observed on backbone links and (2) features of long range dependence and self-similarity are modeled only at fine time scales and are progressively damped as the time period increases. Using the data we collected on the Chinese Education and Research Network, we demonstrate that the proposed model fits 5-min data and generates 10-s aggregates that are similar to actual 10-s data.

The number of faults not discovered by the design review can be estimated by using capture-recapture methods. Since these methods were developed for wildlife population estimation, the assumptions used to derive them do not match design review applications. The authors report on a Monte Carlo simulation to study the effects of broken assumptions on maximum likelihood estimators (MLEs) and jackknife estimators (JEs) of faults remaining. It is found that the MLE performs satisfactorily if faults are classified into a small number of homogeneous groups. Without grouping, the MLE can perform poorly, but it generally does better than the JE.>

Article Estimating software fault content before coding Share on Authors: Stephen G. Eick View Profile , Clive R. Loader View Profile , M. David Long View Profile , Lawrence G. Votta View Profile , Scott Vander Wiel View Profile Authors Info & Claims ICSE '92: Proceedings of the 14th international conference on Software engineeringJune 1992 Pages 59–65https://doi.org/10.1145/143062.143090Online:01 June 1992Publication History 83citation658DownloadsMetricsTotal Citations83Total Downloads658Last 12 Months12Last 6 weeks0 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access