The quest for multi-headed worms

Van Hau Pham, Marc Dacier, Guillaume Urvoy-Keller, Taoufik En-Najjary

Research output: Chapter in Book/Report/Conference proceedingConference contribution

4 Scopus citations


In [6], Pouget et al. have conjectured the existence of so-called multi-headed worms and found a couple of them on attack traces collected on a single honeypot. These worms take advantage of several distinct attack techniques to propagate but they use only one of them against a given target. From a victim's viewpoint, they are therefore indistinguishable from the other classical worms that always propagate using the same attack vector or same sequence of attack vectors. This paper aims at confirming the existence of these worms by studying a very large dataset. The validation process led to three important contributions. First, we establish the existence and assess the importance of three distinct classes of attacks seen in the wild. Second, we propose a new method to correlate attack traces time series and apply it to search for multi-headed worms. Third, we offer and discuss results of the analysis of 15 months of data gathered over 28 different platforms located all over the world. © 2008 Springer-Verlag Berlin Heidelberg.
Original languageEnglish (US)
Title of host publicationLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Number of pages20
StatePublished - Aug 27 2008
Externally publishedYes

Bibliographical note

Generated from Scopus record by KAUST IRTS on 2022-09-12

ASJC Scopus subject areas

  • Theoretical Computer Science
  • General Computer Science


Dive into the research topics of 'The quest for multi-headed worms'. Together they form a unique fingerprint.

Cite this