Smart Detection of Covert Worms in Computer Networks

Document Type : Original Article

Authors

1 imam hossein university

2 iran university of science and technology

Abstract

Complex malwares which infiltrate systems in a country’s critical infrastructure with the purpose of destruction or espionage are major threats in cyber space. What is presented in this article is a smart solution to discover zero day worms which can be polymorphic and encrypted and their nature is still unknown to defense tools.To do this, we first outlined our desirable detector and then presented a solution based on data mining methods for detecting malicious extensions with the emphasis on worm’s scanning feature, communication model of the infected hosts and the packets’ headers transmitted across the network.By clustering clean data, and using clean and contaminated data classifications, experimental samples and the C5 decision tree, we managed to present the best model with an accuracy of 94.49%, precision of 92.92%, and a recall of 94.70% in identifying infected packages from the clean ones. Finally, we also showed that the use of clustering in the patterns of clean hosts’ traffic could reach better results in identifying infected traffic.

Keywords

References

 [1] K. Bartos and M. Sofka, “Robust representation for domain adaptation,” In European Conference on Machine Learning and Knowledge Discovery in Databases, 2015.##
 
[2] P. Prasse, G. Gruben, L. Machlika, T. Pevny, M. Sofka, and T. Scheffer, “Malware Detection by HTTPS Traffic Analysis,” Universität Potsdam, no. computer security, machine learning, p. 10, 2017.##
­
[3] ICSI, “International Computer Science Institute,” Berkeley University of California, [Online]. Available:
 http://www.icir.org/enterprise-tracing/download.html.##

Files

History

  • Receive Date: 15 February 2018
  • Revise Date: 01 July 2018
  • Accept Date: 13 October 2018
  • Publish Date: 20 February 2020

Share

How to cite

Statistics