Using artificial neural networks to detect unknown computer worms |
| |
Authors: | Dima Stopel Robert Moskovitch Zvi Boger Yuval Shahar Yuval Elovici |
| |
Affiliation: | (1) Deutsche Telekom Laboratories at Ben-Gurion University, 84105 Beersheba, Israel;(2) Optimal-Industrial Neural Systems, 84243 Beersheba, Israel |
| |
Abstract: | Detecting computer worms is a highly challenging task. We present a new approach that uses artificial neural networks (ANN)
to detect the presence of computer worms based on measurements of computer behavior. We compare ANN to three other classification
methods and show the advantages of ANN for detection of known worms. We then proceed to evaluate ANN’s ability to detect the
presence of an unknown worm. As the measurement of a large number of system features may require significant computational
resources, we evaluate three feature selection techniques. We show that, using only five features, one can detect an unknown
worm with an average accuracy of 90%. We use a causal index analysis of our trained ANN to identify rules that explain the
relationships between the selected features and the identity of each worm. Finally, we discuss the possible application of
our approach to host-based intrusion detection systems. |
| |
Keywords: | |
本文献已被 SpringerLink 等数据库收录! |
|