Detection of unknown computer worms activity based on computer behavior using data mining

Robert Moskovitch, Ido Gus, Shay Pluderman, Dima Stopel, Clint Feher, Chanan Glezer, Yuval Shahar, Yuval Elovici

نتاج البحث: فصل من :كتاب / تقرير / مؤتمرمنشور من مؤتمرمراجعة النظراء

6 اقتباسات (Scopus)

ملخص

Detecting unknown worms is a challenging task. Extant solutions, such as anti-virus tools, rely mainly on prior explicit knowledge of specific worm signatures. As a result, after the appearance of a new worm on the Web there is a significant delay until an update carrying the worm's signature is distributed to anti-virus tools. During this time interval a new worm can infect many computers and cause significant damage. We propose an innovative technique for detecting the presence of an unknown worm, not necessarily by recognizing specific instances of the worm, but rather based on the computer measurements. We designed an experiment to test the new technique employing several computer configurations and background applications activity. During the experiments 323 computer features were monitored. Four feature selection techniques were used to reduce the amount of features and four classification algorithms were applied on the resulting feature subsets. Our results indicate that using this approach resulted in exceeding 90% mean accuracy, and for specific unknown worms accuracy reached above 99%, using just 20 features while maintaining a low level of false positive rate.

اللغة الأصليةالإنجليزيّة
عنوان منشور المضيفProceedings of the 2007 IEEE Symposium on Computational Intelligence and Data Mining, CIDM 2007
الصفحات202-209
عدد الصفحات8
المعرِّفات الرقمية للأشياء
حالة النشرنُشِر - 2007
منشور خارجيًانعم
الحدث1st IEEE Symposium on Computational Intelligence and Data Mining, CIDM 2007 - Honolulu, HI, الولايات المتّحدة
المدة: ١ أبريل ٢٠٠٧٥ أبريل ٢٠٠٧

سلسلة المنشورات

الاسمProceedings of the 2007 IEEE Symposium on Computational Intelligence and Data Mining, CIDM 2007

!!Conference

!!Conference1st IEEE Symposium on Computational Intelligence and Data Mining, CIDM 2007
الدولة/الإقليمالولايات المتّحدة
المدينةHonolulu, HI
المدة١/٠٤/٠٧٥/٠٤/٠٧

بصمة

أدرس بدقة موضوعات البحث “Detection of unknown computer worms activity based on computer behavior using data mining'. فهما يشكلان معًا بصمة فريدة.

قم بذكر هذا