Novel implementation of a worm detection system using protocol graphs

Computer worms are self-propagating malicious entities that spread throughout a network or the entire internet, causing irreparable damage. More sophisticated worms emerged and a continuous race between attackers and defenders is ongoing. In order to detect the effects caused by these worms on a network, we have implemented an efficient algorithm that uses the Protocol Graph method for the detection and prevention of worm propagation. The system is implemented using C++ and a Perl wrapper, with a frontend. The system will be able to distinguish malicious traffic in real time based on effective statistical methods. Our algorithm is very efficient and we have included a survey of possible implementation methods and the reason as to why our method proves to be unique and efficient.