Employing machine learning algorithms to detect unknown scanning and email worms
Joint Authors
al-Nasiri, Amir
Abd Allah, Shubayr
Ramadass, Sureswaran
al-Tayyib, al-Tayyib al-Tahir
Source
The International Arab Journal of Information Technology
Issue
Vol. 11, Issue 2 (31 Mar. 2014)9 p.
Publisher
Publication Date
2014-03-31
Country of Publication
Jordan
No. of Pages
9
Main Subjects
Information Technology and Computer Science
Topics
Abstract EN
we present a worm detection system that leverages the reliability of IP-Flow and the effectiveness of learning machines.
Typically, a host infected by a scanning or an email worm initiates a significant amount of traffic that does not rely on DNS to translate names into numeric IP addresses.
Based on this fact, we capture and classify NetFlow records to extract feature patterns for each PC on the network within a certain period of time.
A feature pattern includes: no of DNS requests, no of DNS responses, no of DNS normals, and no of DNS anomalies.
Two learning machines are used, K-Nearest Neighbors (KNN) and Naïve Bayes (NB), for the purpose of classification.
Solid statistical tests, the cross-validation and paired t-test, are conducted to compare the individual performance between the KNN and NB algorithms.
We used the classification accuracy, false alarm rates, and training time as metrics of performance to conclude which algorithm is superior to another.
The data set used in training and testing the algorithms is created by using 18 real-life worm variants along with a big amount of benign flows.
American Psychological Association (APA)
Abd Allah, Shubayr& Ramadass, Sureswaran& al-Tayyib, al-Tayyib al-Tahir& al-Nasiri, Amir. 2014. Employing machine learning algorithms to detect unknown scanning and email worms. The International Arab Journal of Information Technology،Vol. 11, no. 2.
https://search.emarefa.net/detail/BIM-334208
Modern Language Association (MLA)
Abd Allah, Shubayr…[et al.]. Employing machine learning algorithms to detect unknown scanning and email worms. The International Arab Journal of Information Technology Vol. 11, no. 2 (Mar. 2014).
https://search.emarefa.net/detail/BIM-334208
American Medical Association (AMA)
Abd Allah, Shubayr& Ramadass, Sureswaran& al-Tayyib, al-Tayyib al-Tahir& al-Nasiri, Amir. Employing machine learning algorithms to detect unknown scanning and email worms. The International Arab Journal of Information Technology. 2014. Vol. 11, no. 2.
https://search.emarefa.net/detail/BIM-334208
Data Type
Journal Articles
Language
English
Notes
Includes bibliographical references
Record ID
BIM-334208