Improving Worm Detection with Artificial Neural Networks through Feature Selection and Temporal Analysis Techniques

Dima Stopel, Zvi Boger, Robert Moskovitch, Yuval Shahar, Yuval Elovici

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review


Computer worm detection is commonly performed by antivirus software tools that rely on prior explicit knowledge of the worm’s code (detection based on code signatures). We present an approach for detection of the presence of computer worms based on Artificial Neural Networks (ANN) using the computer's behavioral measures. Identification of significant features, which describe the
activity of a worm within a host, is commonly acquired from security experts. We suggest acquiring these features by applying feature selection methods. We compare three different feature selection techniques for the dimensionality reduction and identification of the most prominent features to capture efficiently the computer behavior in the context of worm activity. Additionally, we explore three different temporal representation techniques for the most prominent features. In order to evaluate the different techniques, several computers were infected with five different worms and 323 different features of the infected computers were measured. We evaluated each technique by preprocessing the dataset according to each one and training the ANN model with the preprocessed data. We then evaluated the ability of the model to detect the presence of a new computer worm, in particular, during heavy user activity on the infected computers.
Original languageEnglish
Title of host publicationProceedings of World Academy of Science Engineering and Technology
StatePublished - 2006


  • Artificial Neural Networks
  • Feature Selection
  • Temporal Analysis
  • Worm Detection


Dive into the research topics of 'Improving Worm Detection with Artificial Neural Networks through Feature Selection and Temporal Analysis Techniques'. Together they form a unique fingerprint.

Cite this