A new approach for internet worm detection and classification

Conference proceedings article

ผู้เขียน/บรรณาธิการ

นฤมล วัฒนพงศกร

กลุ่มสาขาการวิจัยเชิงกลยุทธ์

ไม่พบข้อมูลที่เกี่ยวข้อง

รายละเอียดสำหรับงานพิมพ์

รายชื่อผู้แต่ง: Sarnsuwan N., Charnsripinyo C., Wattanapongsakorn N.

ผู้เผยแพร่: Hindawi

ปีที่เผยแพร่ (ค.ศ.): 2010

หน้าแรก: 38

หน้าสุดท้าย: 41

จำนวนหน้า: 4

ISBN: 9788988678206

eISSN: 1745-4557

URL: https://www.scopus.com/inward/record.uri?eid=2-s2.0-77954785215&partnerID=40&md5=199985f6c5c7f0b0e7ee8b015fe1a016

ภาษา: English-Great Britain (EN-GB)

บทคัดย่อ

To detect internet worm, many academic approaches have been proposed. In this paper, we provide a new approach to detect internet worm. We consider behaviors of internet worm that is different from the normal pattern of internet activities. We consider all network packets before they reach to the end-user by extracting a certain number of features of internet worm from these packets. Our network features mainly consist of characteristics of IP address, port, protocol and some flags of packet header. These features are used to detect and classify behavior of internet worm by using 3 different data mining algorithms which are Bayesian Network, Decision Tree and Random Forest. In addition, our approach not only can classify internet worm apart from the normal data, but also can classify network attacks that have similar behaviors to the internet worm behaviors. Our approach provides good results with detection rate over 99.6 percent and false alarm rate is close to zero with Random forest algorithm. In addition, our model can classify behaviors of DoS and Port Scan attacks with detection rate higher than 98 percent and false alarm rate equal to zero.

คำสำคัญ