Anomaly-based worm detection is a complement to existing signature-based worm detectors. It detects unknown worms and fills the gap between when a worm is propagated and when a signature is generated and downloaded to a signature-based worm detector. A major obstacle for its deployment to personal computers (PCs) is its high false positive alarms since a typical PC user lacks the skill to handle exceptions flagged by a detector without much knowledge of computers. In this paper, we exploit the feature of personal computers in which the user interacts with many running programs and the features combining various network characteristics. The model of a program's network behaviors is conditioned on the human interactions with the program. Our scheme automates detection of unknown worms with dramatically reduced false positive alarms while not compromising low false negatives, as proved by our experimental results from an implementation on Windows-based PCs to detect real world worms.

There has been growing interest in Broadband ISDN (B-ISDN) based on ATM (Asynchronous Transfer Mode) technologies, since ATM is expected to support a wide range of applications through high-speed and flexible multimedia communication capabilities. This paper reviews and discusses technical issues on multimedia communication protocols and services from the integration points of view of computer and communication technologies. An ISDN-based distributed multimedia and multi-party desktop conference system called MERMAID is introduced as an example which offers highly-sophisticated functions for remote collaborations among multiple users. This system, which was developed in early 1989 and has been used for daily research work since then, involves B-ISDN key technologies related to multimedia and multicast protocols, and computer architecture for groupware applications.