Abstract

Computer worms spread by scanning Internet addresses at random and, if a vulnerable machine is found at that address, infecting it. While they can potentially spread very fast, their scanning behaviour provides a way of distinguishing them from legitimate applications and, possibly, of quarantining infected machines in time. I will pose this as a change-point detection problem and discuss some classical statistical techniques for solving it. We'll then discuss some extensions, as well as some of the issues involved in applying these techniques in practice.

FRIDAY, February 25, 2005
Time: 4:30 P.M.
Location: WeH 7500