Application of artificial neural networks techniques to computer worm detection

Dima Stopel, Zvi Boger, Robert Moskovitch, Yuval Shahar, Yuval Elovici

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

29 Scopus citations

Abstract

Detecting computer worms is a highly challenging task. Commonly this task is performed by antivirus software tools that rely on prior explicit knowledge of the worm's code, which is represented by signatures. We present a new approach based on Artificial Neural Networks (AMN) for detecting the presence of computer worms based on the computer's behavioral measures. In order to evaluate the new approach, several computers were infected with seven different worms and more than sixty different parameters of the infected computers were measured. The ANN and two other known classifications techniques, Decision Tree and k -Nearest Neighbors, were used to test their ability to classify correctly the presence, and the type, of the computer worms even during heavy user activity on the infected computers. The comparisons between the three approaches suggest that the ANN approach have computational advantages when real-time computation is needed, and has the potential to detect previously unknown worms. In addition, ANN may be used to identify the most relevant, measurable, features and thus reduce the feature dimensionality.

Original languageEnglish
Title of host publicationInternational Joint Conference on Neural Networks 2006, IJCNN '06
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages2362-2369
ISBN (Print)0780394909, 9780780394902
DOIs
StatePublished - 1 Jan 2006
EventInternational Joint Conference on Neural Networks 2006, IJCNN '06 - Vancouver, BC, Canada
Duration: 16 Jul 200621 Jul 2006

Publication series

NameIEEE International Conference on Neural Networks - Conference Proceedings
ISSN (Print)1098-7576

Conference

ConferenceInternational Joint Conference on Neural Networks 2006, IJCNN '06
Country/TerritoryCanada
CityVancouver, BC
Period16/07/0621/07/06

ASJC Scopus subject areas

  • Software

Fingerprint

Dive into the research topics of 'Application of artificial neural networks techniques to computer worm detection'. Together they form a unique fingerprint.

Cite this