A new approach for internet worm detection and classification
Conference proceedings article
Authors/Editors
Strategic Research Themes
No matching items found.
Publication Details
Author list: Sarnsuwan N., Charnsripinyo C., Wattanapongsakorn N.
Publisher: Hindawi
Publication year: 2010
Start page: 38
End page: 41
Number of pages: 4
ISBN: 9788988678206
eISSN: 1745-4557
Languages: English-Great Britain (EN-GB)
Abstract
To detect internet worm, many academic approaches have been proposed. In this paper, we provide a new approach to detect internet worm. We consider behaviors of internet worm that is different from the normal pattern of internet activities. We consider all network packets before they reach to the end-user by extracting a certain number of features of internet worm from these packets. Our network features mainly consist of characteristics of IP address, port, protocol and some flags of packet header. These features are used to detect and classify behavior of internet worm by using 3 different data mining algorithms which are Bayesian Network, Decision Tree and Random Forest. In addition, our approach not only can classify internet worm apart from the normal data, but also can classify network attacks that have similar behaviors to the internet worm behaviors. Our approach provides good results with detection rate over 99.6 percent and false alarm rate is close to zero with Random forest algorithm. In addition, our model can classify behaviors of DoS and Port Scan attacks with detection rate higher than 98 percent and false alarm rate equal to zero.
Keywords
No matching items found.
Contact Information