Worm Analysis

A computer worm is a self-replicating malware computer program, It uses a computer network to send copies of itself to other nodes and it may do so without any user intervention. To spread itself, it always need network, either directly affecting others computers or sending out by emails.

Based on the activities of each conversation, Capsa will recognize the worm activities against the thresholds you configured. Generally the computer worms have the following characteristics:

• Sending packets out in fast speed
• Trying to establish a large number of connections
• Send packet number greater than receive packet number
• Small average packet length

All the computer worm will be recognized against their default threshold values, you can customize these values to let Capsa find out the problems more accurately in your network, read Security Analysis Settings for details.