  Internet worms cause billions of dollars in damage yearly, affecting millions
of users worldwide. For countermeasures to be deployed timeously, it is
necessary to use an automated system to detect the spread of a worm. This paper
discusses a method of determining the presence of a worm, based on routing
information currently available from Internet routers. An autoencoder, which is
a specialized type of neural network, was used to detect anomalies in normal
routing behavior. The autoencoder was trained using information from a single
router, and was able to detect both global instability caused by worms as well
as localized routing instability.
