{'fraction_non_alphanumeric': 0.019230769230769232, 'fraction_numerical': 0.0019230769230769232, 'mean_word_length': 4.9147727272727275, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Anomaly Detection in Network Traffic and Automatic Filtering

Detection of fast-spreading Internet worms is a problem that continues to be a burden on businesses and Internet Service Providers. In this paper we present a Simple Worm Detection scheme (SWorD). SWorD is designed as a statistical detection method for detecting and automatically filtering fast-spreading worms. SWorD is a simple two-tier counting algorithm designed to be deployed on the network edge. The first-tier is a lightweight traffic filter while the second-tier is more selective and rarely invoked. We present results using network traces from both a small and large network to demonstrate SWorD’s performance. Our results show that SWorD accurately detects over 75% of all infected hosts within six seconds, making it an attractive solution for the worm detection problem. The views expressed in this paper are those of the author and do not reflect the official policy or position of the United States Government, the Department of Defense, or any of its agencies.