Adaptive sequential hypothesis testing for accurate detection of scanning worms

Tsern-Huei Lee*, Sung Yen Lee

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review


Early detction techniques of scaning worms are based on simple observations of high port/address scanning rates of malicious hosts. Such apporaches are not able to detect stealthy scanners and can be easily evaded once the threshold of scanning rate for generating alerts is known to the attackers. To overcome this problem, sequential hypothesis testing was developed as an alternative detection technique. It was found that the technique based on sequential hypothesis testing can detect scanning worms faster than those based on scanning rates in the sense that it needs fewer observations for the outcomes of connection attempts. However, the performance of the detection technique based on sequential hypothesis testing is sensitve to the probabilities of success for the first-contact connection attempts sent by benign and malicious hosts. The false positive and false negative probabilities could be much larger than the desired values if these probabilities are not known. In this paper, we presnt a simple adpative algorithm which provides accurate estimates of these probabilities. Numerical results show that the proposed adaptive estimation algorithm is an important enhancement of sequential hypothesis testing because it makes the technique robust for detection of scanning worms.

Original languageEnglish
Title of host publicationTENCON 2009 - 2009 IEEE Region 10 Conference
StatePublished - 1 Dec 2009
Event2009 IEEE Region 10 Conference, TENCON 2009 - Singapore, Singapore
Duration: 23 Nov 200926 Nov 2009

Publication series

NameIEEE Region 10 Annual International Conference, Proceedings/TENCON


Conference2009 IEEE Region 10 Conference, TENCON 2009


  • Adaptive
  • Network security
  • Sequential hypothesis testing

Fingerprint Dive into the research topics of 'Adaptive sequential hypothesis testing for accurate detection of scanning worms'. Together they form a unique fingerprint.

Cite this