Computer Worms: Architectures, Evasion Strategies, and Detection Mechanisms

Abstract: This paper surveys the Internet worms-related literature and how stealthy worm behaviour can be discovered. Discussion is provided on the anatomy of worms, specifically covering the mech-anisms by which worms spread, how they are detected, and how they may attempt to hide. The paper presents common detection mechanisms that we divide based on worm architecture properties. Namely, we summarize how worms can be detected at each of the following stages: target discovery, while they are being distributed, while being activated at the hosts, and when they run their payloads (where applicable). We also discuss some attack patterns for famous recent worms. The paper concludes with a discussion on current so-lutions (academic research, commercial products, and open-source tools) to detect worms and a comparative summary of these solu-tions/tools ’ capabilities