Worm Detection Research Articles

Utilizing the ultrasensitive Schistosoma up-converting phosphor lateral flow circulating anodic antigen (UCP-LF CAA) assay for sample pooling-strategies

BackgroundMethodological applications of the high sensitivity genus-specific Schistosoma CAA strip test, allowing detection of single worm active infections (ultimate sensitivity), are discussed for efficient utilization in sample pooling strategies. Besides relevant cost reduction, pooling of samples rather than individual testing can provide valuable data for large scale mapping, surveillance, and monitoring.MethodThe laboratory-based CAA strip test utilizes luminescent quantitative up-converting phosphor (UCP) reporter particles and a rapid user-friendly lateral flow (LF) assay format. The test includes a sample preparation step that permits virtually unlimited sample concentration with urine, reaching ultimate sensitivity (single worm detection) at 100% specificity. This facilitates testing large urine pools from many individuals with minimal loss of sensitivity and specificity. The test determines the average CAA level of the individuals in the pool thus indicating overall worm burden and prevalence. When requiring test results at the individual level, smaller pools need to be analysed with the pool-size based on expected prevalence or when unknown, on the average CAA level of a larger group; CAA negative pools do not require individual test results and thus reduce the number of tests.ResultsStraightforward pooling strategies indicate that at sub-population level the CAA strip test is an efficient assay for general mapping, identification of hotspots, determination of stratified infection levels, and accurate monitoring of mass drug administrations (MDA). At the individual level, the number of tests can be reduced i.e. in low endemic settings as the pool size can be increased as opposed to prevalence decrease.ConclusionsAt the sub-population level, average CAA concentrations determined in urine pools can be an appropriate measure indicating worm burden. Pooling strategies allowing this type of large scale testing are feasible with the various CAA strip test formats and do not affect sensitivity and specificity. It allows cost efficient stratified testing and monitoring of worm burden at the sub-population level, ideally for large-scale surveillance generating hard data for performance of MDA programs and strategic planning when moving towards transmission-stop and elimination.

Smart XSS Attack Surveillance System for OSN in Virtualized Intelligence Network of Nodes of Fog Computing

This article introduces a distributed intelligence network of Fog computing nodes and Cloud data centres for smart devices against XSS vulnerabilities in Online Social Network (OSN). The cloud data centres compute the features of JavaScript, injects them in the form of comments and saved them in the script nodes of Document Object Model (DOM) tree. The network of Fog devices re-executes the feature computation and comment injection process in the HTTP response message and compares such comments with those calculated in the cloud data centres. Any divergence observed will simply alarm the signal of injection of XSS worms on the nodes of fog located at the edge of the network. The mitigation of such worms is done by executing the nested context-sensitive sanitization on the malicious variables of JavaScript code embedded in such worms. The prototype of the authors' work was developed in Java development framework and installed on the virtual machines of Cloud data centres (typically located at the core of network) and the nodes of Fog devices (exclusively positioned at the edge of network). Vulnerable OSN-based web applications were utilized for evaluating the XSS worm detection capability of the authors' framework and evaluation results revealed that their work detects the injection of XSS worms with high precision rate and less rate of false positives and false negatives.

Evaluation of EWCDMCC Cloud Worm Detection Classification Based on Statistical Analysis

Evaluation of EWCDMCC Cloud Worm Detection Classification Based on Statistical Analysis

Distributed Detection of Sensor Worms Using Sequential Analysis and Remote Software Attestations

Recent work has demonstrated that self-propagating worms are a real threat to sensor networks. Since worms can enable an adversary to quickly compromise an entire sensor network, they must be detected and stopped as quickly as possible. To meet this need, we propose a worm propagation detection scheme for sensor networks. The proposed scheme applies a sequential analysis to detect worm propagation by leveraging the intuition that a worm’s communication pattern is different from benign traffic. In particular, a worm in a sensor network requires a long sequence of packets propagating hop-by-hop to each new infected node in turn. We thus have detectors that observe communication patterns in the network, a worm spreading hop-by-hop will quickly create chains of connections that would not be seen in normal traffic. Once detector nodes identify the worm propagation pattern, they initiate remote software attestations to detect infected nodes. Through analysis and simulation, we demonstrate that the proposed scheme effectively and efficiently detects worm propagation. In particular, it blocks worm propagation while restricting the fraction of infected nodes to at most 13.5% with an overhead of at most 0.63 remote attestations per node per time slot.

Malicious Traffic Detection and Containment based on Connection Attempt Failures using Kernelized ELM with Automated Worm Containment Algorithm

Objectives: In the world of Internet today, most of the communications are done through Internet applications. Rapidly with the growth of Internet, the security threat on Internet is also increasing. Internet worms are one of the serious dangerous threats heavy financial losses. To overcome these damages, the proposed methodology provide better defense mechanism through Internet worm detection and containment schemes based on connection attempt failures characteristic. Method: The Internet worm detection is done using the Machine Learning Method based on Anomaly detection schemes and containment based on blocking schemes. The proposed kernelized Extreme Learning Machine with Automated Worm Containment Algorithm (kEA) method is used for detection and containment of malicious traffic from non-existing IP addresses based on connection attempt failures. Findings: Second channel based propagation through botnet worms propagates illegal traffic from malicious IP addresses through connection attempt failures. This traffic is transferred through TCP and UDP transmission schemes. The proposed work is used to identify the second channel propagating worms and containment of malicious traffic. Improvement: The proposed kernelized Extreme Learning Machine (kELM) method achieved detection accuracy improved by 23.67%. Then proposed kEA method blocks all the detected malicious IP addresses with 100% containment at the time span of 33 ms.

SMART WORMS DEFENSE AND DETECTION

There are several worm attacks in the recent years, this leads to an essentiality of producing new detection technique for worm attacks. In this paper we present a spectrum based smart worm detection scheme, this is based on the idea of detection of worm in the frequency domain. This scheme uses the power spectral density of the scan traffic volume and its corresponding flatness measure to distinguish the smart worm traffic from background traffic. This scheme showed better results against the smart worms and also for the c-worm detection.

Anomaly Detection Using the Dempster-Shafer Method

In this paper, we implement an anomaly detection system using the Dempster-Shafer method. Using two standard benchmark problems we show that by combining multiple signals it is possible to achieve better results than by using a single signal. We further show that by applying this approach to a real-world email dataset the algorithm works for email worm detection. Dempster-Shafer can be a promising method for anomaly detection problems with multiple features (data sources), and two or more classes.

Design and Development of Humiliating of C-Worm Utilizing an Arbitrary Visualizing

A worm is a malicious self-replicating programs, it is intended to feast via computer links. The computer worms are one method of malware beside with Trojans and Viruses. The active worms impersonate main refuge threats to that an Internet. This is the ability of active worms to continuously propagate in the computers on the Internet as an automated fashion. The Active worms changes through their circulation, and thus, pose large tasks to preserve alongside them. This manuscript, to explore an original class of active worms, denoted to as Camouflaging Worm (Abbreviated to as C-Worm) respectively. The C-Worm means different from traditional worms because of its ability to intelligently manipulate its scan traffic size over time respectively. So, the C-Worm camouflages its circulation from prevailing worm detection systems constructed on investigating the circulation traffic produced by worms respectively. To analyze characteristics of the C- Worm and conduct a comprehensive comparison between its non-worm traffic and traffic respectively. To detect that these double kinds of traffic are barely different in the time sphere. Though, their difference is clear in the incidence sphere, due to the periodic devious environment of the C-Worm respectively. Interested by these clarifications, it designs a novel spectrum-constructed pattern to detect the C-Worm. This pattern consumes the Power Spectral Density (PSD) circulation of the scan traffic size and its corresponding Spectral Flatness Measure (SFM) respectively, to distinguish the C-Worm traffic from related traffic. Consuming a complete group of detection metrics and real-world suggestions as contextual traffic, it directs widespread implementation estimates on these planned spectrumconstructed detection pattern. This implementation data evidently establishes that this pattern can efficiently detect the C-Worm circulation. Besides, to display the simplification of this spectrum-based pattern in efficiently detecting not only the C-Worm, although conventional worms also.

Anomaly based Malicious Traffic Identification using Kernel Extreme Machine Learning (KELM) Classifier and Kernel Principal Component Analysis (KPCA)

Objectives: The rapid growth of new vulnerabilities causes the network by Denial of Service attack (DoS). The DoSattack causes traffic flow in network. Therefore it increases the difficulties to detect the DoSattack in traffic by means of misuse detection. The behavior patterns are analyzed in anomaly Anomaly detection to identify the attack. Methods: In detection of unknown worms anomaly detection is more comfortable than misuse detection. In this paper, hybrid optimization and extreme machine learning classifier is proposed for anomaly detection. This approach detects the DoSattack by analyzing the profiles of traffic patterns. Findings: Principal Component Analysis (PCA) is adopted in this approach to extract the feature from the dataset. A short time window is utilized to gather all features from packet headers. Extreme learning machine based HGAPSO is used to classify the unknown attack. Improvement: thus the proposed system is implemented as real-time. Performance evaluation shows that this approach provides 1.016s time consumption and 95 % accuracy tan existing approach during detection of DoSin network traffic.

NEDAC: A worm countermeasure mechanism

This article presents an Internet worm countermeasure mechanism that uses DNS activities as a behavioural technique to detect worm propagation. The mechanism also uses a data-link containment solution to block traffic from an infected host. The concept has been demonstrated using a developed prototype and tested in a virtualised network environment. An empirical analysis of network worm propagation has been conducted to test the capabilities of the developed countermeasure mechanism. The results show that the developed mechanism is sensitive in containing Internet worms. Keywords : Worm Detection, Malware, cyber defense

Echinococcus multilocularis: Epidemiology, surveillance and state-of-the-art diagnostics from a veterinary public health perspective

Alveolar echinococcosis (AE), caused by the larval (metacestode) stage of Echinococcus multilocularis, is considered one of the most serious parasitic zoonoses in Central and Eastern Europe and is emerging also in large parts of Asia and in North America. The red fox represents the main definitive host of E. multilocularis in Europe, but the raccoon dog, the domestic dog and to a much lesser extent the domestic cat also represent potential definitive hosts. The natural intermediate hosts of E. multilocularis are mainly voles. The spectrum of accidental hosts is broad and includes many species of monkeys, pigs, dogs and humans which get infected by oral uptake of the viable eggs. Yet, human AE is a very rare disease in Europe; incidences have increased in recent years, while the infection is widely distributed in foxes with high prevalences reaching up to 70% in some areas. Generally, infected foxes represent a zoonotic risk, which may be particularly relevant in urban areas. Furthermore, there is concern that the risk for humans to acquire AE may rise due to the suspected geographical spread of the parasite as assessed by infections in its definitive hosts and the high prevalences in some regions. Monitoring and surveillance activities have therefore been initiated in a few European countries. Several diagnostic strategies have been developed and validated in recent years, applying classical worm detection by microscopy, but also immunological (ELISA for coproantigen detection) and molecular tests (copro-DNA detection by PCR). However, there is an urgent need for defining minimal requirements and harmonised approaches for these activities to allow for a reliable assessment of the epidemiological situation in Europe and comparable results from different countries.

Improved sensitivity of the urine CAA lateral-flow assay for diagnosing active Schistosoma infections by using larger sample volumes.

BackgroundAccurate determination of Schistosoma infection rates in low endemic regions to examine progress towards interruption of transmission and elimination requires highly sensitive diagnostic tools. An existing lateral flow (LF) based test demonstrating ongoing infections through detection of worm circulating anodic antigen (CAA), was improved for sensitivity through implementation of a protocol allowing increased sample input. Urine is the preferred sample as collection is non-invasive and sample volume is generally not a restriction.MethodsCentrifugal filtration devices provided a method to concentrate supernatant of urine samples extracted with trichloroacetic acid (TCA). For field trials a practical sample volume of 2 mL urine allowed detection of CAA down to 0.3 pg/mL. The method was evaluated on a set of urine samples (n = 113) from an S. mansoni endemic region (Kisumu, Kenya) and compared to stool microscopy (Kato Katz, KK). In this analysis true positivity was defined as a sample with either a positive KK or UCAA test.ResultsImplementation of the concentration method increased clinical sensitivity (Sn) from 44 to 98% when moving from the standard 10 μL (UCAA10 assay) to 2000 μL (UCAA2000 assay) urine sample input. Sn for KK varied between 23 and 35% for a duplicate KK (single stool, two slides) to 52% for a six-fold KK (three consecutive day stools, two slides). The UCAA2000 assay indicated 47 positive samples with CAA concentration above 0.3 pg/mL. The six-fold KK detected 25 egg positives; 1 sample with 2 eggs detected in the 6-fold KK was not identified with the UCAA2000 assay.ConclusionsLarger sample input increased Sn of the UCAA assay to a level indicating ‘true’ infection. Only a single 2 mL urine sample is needed, but analysing larger sample volumes could still increase test accuracy. The UCAA2000 test is an appropriate candidate for accurate identification of all infected individuals in low-endemic regions. Assay materials do not require refrigeration and collected urine samples may be stored and transported to central test laboratories without the need to be frozen.

A Continuous-Flow C. elegans Sorting System with Integrated Optical Fiber Detection and Laminar Flow Switching

Sorting of C.elegans genotypes is a routine task in most C.elegans research labs. Conventionally, the worms are sorted manually which is both labor intensive and slow. In recent years microfluidics has become a useful and important tool for biologists to study C.elegans, including sorting. Although they have shown successful sorting results, the immobilization of worms which was adopted in most of these works causes aversive stimulation to the worms and their behavior will potentially be altered when carrying out post-sorting characterizations. In this work, both worm detection and switching are achieved without any intervention of the continuous worm flow. The genotypes of the worms are detected by integrated optical fibers based on their fluorescence, without the need for immobilization. Switching is based on the steering of laminar flow boundaries. A novel design that integrates two control inlets dynamically switches the fluidic flow to desired outlets by changing the relative pressure in the control inlets, which cause the two laminar flow boundaries to steer. Compared to previously reported microfluidic C. elegans sorting devices, sorting in this system is conducted in a continuous flow environment without any immobilization technique or need for multilayer mechanical valves to open and close the outlets. The continuous flow sorter not only increases the throughput but also avoids any kind of invasive or possibly damaging mechanical or chemical stimulus. We have characterized both the detection and the switching accuracy of the sorting device at different flow rates, and efficiencies approaching 100% can be achieved with a high throughput of about 1 worm/s. To confirm that there was no significant damage to C. elegans following sorting, we recovered the sorted worms, finding no differences in behavior and propagation compared to control.

Incidental detection of filarial worm in metastatic axillary lymph node from ductal carcinoma breast

Filariasis is a major disease of the tropics. Frequently, lymphatics of the lower limbs, retroperitoneal tissues, spermatic cord, epididymis, and mammary glands are involved. Simultaneous filariasis along with another underlying disease is rare. We present a rare case of filariasis of the axillary lymph node in a modified radical mastectomy specimen, which also showed metastatic deposits of ductal carcinoma breast. The case is presented due to its rarity.

A Tour of the Computer Worm Detection Space

Computer worm detection has been a challenging and often elusive task. This is partly because of the difficulty of accurately modeling either the normal behavior of computer networks or the malicious actions of computer worms. This paper presents a literature review on the worm detection techniques, highlighting the worm characteristics leveraged for detection and the limitations of the various detection techniques. The paper broadly categorizes the worm detection approaches into content signature based detection, polymorphic worm detection, anomaly based detection, and behavioral signature based detection. The gap in the literature in the techniques is indicated and is the main contribution of the paper. General Terms Malware detection, Computer Worm detection, Detection Techniques, Worm Characteristics

A Novel Method for Detection of Internet Worm Malcodes using Principal Component Analysis and Multiclass Support Vector Machine

Internet worms are malware programs that imitate themselves and spread around the network. Internet worm, a wide spreading malcode exploits vulnerability in the operating system, hard disk, software and web browsers. This paper analyzes and classifies the Internet worm, depending on the training signatures. This work presents the Internet worm detection mechanism, using Principal Component Analysis (PCA) and Support Vector Machine (SVM). A Selective sampling technique is applied to maximize the performance of the classifier and to reduce misleading data instances. The results obtained show improved memory utilization, detection time and detection accuracy for Internet worms. Keyword - Malcode, Selective sampling, Multiclass SVM and PCA

Survey of Polymorphic Worm Signatures

Worms are self –replicating, fast moving malicious codes, capable of spreading themselves without human interaction. It’s a weapon of choice for those, who like to launch destructive attacks on network or internet as a whole. Recently there emerge more sophisticated worms such as polymorphic worm which vary their payload in every infection attempt. Polymorphic worms have more than one mutated instances. It is very important to detect and prevent such worms quickly and accurately at their early phase of infection. There are several worm detection and containment methods available. This paper surveys recent automated signature based detection of polymorphic worms and presents a classification for various signature approaches. There are two main categories of worm signatures, exploit specific and vulnerability driven. Both categories of signature are either network-based or host based. Each signature generation scheme is described and discussed in appropriate category. We analyze and compare different signature schemes. The paper concludes with challenge and scope of future research directions.

Hybrid Swarm Intelligence and Artificial Neural Network for Mitigating Malware Effects

Today networks are interconnected wired and wireless network. With the explosive growth and increasing complexity of network applications, malware attacks such as worm attack against network are critical. Although of the evolution of worm detection techniques, worms are still the most malware threats attacking computer systems. Early detection of unknown worms is still a problem. Swarm Intelligence (SI) in recent patents seeks inspiration in the behavior of swarms of insects or other animals such as ants. SI is applied in other fields with success. We used it in the field of worm detection. Artificial neural networks may either be used to gain an understanding of biological neural networks, or for solving artificial intelligence problems without necessarily creating a model of a real biological system. This paper introduces a system for detecting unknown worms based on the collected information from local victim using Particle Swarm Optimization (PSO) and Artificial Neural Network (ANN). This system can detect unknown worms effectively in both small and large size networks. In addition, this system produces prediction to the infection percentage in the network. This prediction mechanism supports the network administrator in decision-making process to respond quickly to worm propagation accurately. Keywords: Artificial neural network, local victim information, particle swarm optimization, swarm intelligence, worm detection

Microfilaria with neoplasm – a chance diagnosis by fine needle aspiration cytology

Filariasis is endemic in developing countries with highest prevalence in India. Detection of microfilariae, adult worm or egg in fine needle aspirate is very unusual despite the high incidence of this parasite. Its association with neoplasia is still rare with only a few reported cases of coexistent microfilaria with neoplasm. We report a case of a 70 year male with cervical lymphadenopathy where cytological diagnosis of Non-Hodgkin’s lymphoma with chance detection of filariasis was made. This case highlights the importance of cytological smear as a useful diagnostic aid for detection of parasites in clinically unsuspected cases.

SECURITY BREACH IN TRADING SYSTEM-COUNTERMEASURE USING IPTRACEBACK

Recently, economic scenario is often facing securit y breach that has heavy impact on the financial soundness of a company particularly, stock prices o n firms. The utmost consequence being the whole business comes to a standstill. From the estimates attributed by the financial sector, it has been inf erred that the loss incurred on virus and worms attack is said to have the greatest impact that hampers the prosp erity of a business entity. Thus, security strategies attemp t on revolving around the act of security breach, t hereby targeting to curb the financial losses of a company totally or at least minimize the losses. If the op erating system of the stock market or financial sector gets corrupted the whole system need to be formatted, a new operating system has to be reinstalled and the anti virus software tends to be useless in such cases. I n this study, virus and worms are encountered using IPTraceback technique and network security is ensured. Th e effective integration of spectral analysis, worm de tection and IPTraceback, alerts the user dynamicall y and kills the source which distributes the virus. Real time traffic data are used for evaluating the perfo rmance.