Detecting worm variants using machine learning

Sharma, O., Girolami, M. and Sventek, J. (2007) Detecting worm variants using machine learning. In: ACM CoNEXT Conference, New York, NY, USA, 10-13 Dec 2007, (doi: 10.1145/1364654.1364657)

Abstract

<p>Network intrusion detection systems typically detect worms by examining packet or flow logs for known signatures. Not only does this approach mean worms cannot be detected until the signatures are created, but that variants of known worms will remain undetected since they will have different signatures. The intuitive solution is to write more generic signatures. This solution, however, would increase the false alarm rate and is therefore practically not feasible. This paper reports on the feasibility of using a machine learning technique to detect variants of known worms in real-time.</p> <p>Support vector machines (SVMs) are a machine learning technique known to perform well at various pattern recognition tasks, such as text categorization and handwritten digit recognition. Given the efficacy of SVMs in standard pattern recognition problems this work applies SVMs to the worm detection problem. Specifically, we investigate the optimal configuration of SVMs and associated kernel functions to classify various types of synthetically generated worms. We demonstrate that the optimal configuration for real time detection of variants of known worms is to use a linear kernel, and unnormalized bi-gram frequency counts as input.</p>

• Item Type: Conference Proceedings
• Additional Information: ISBN: 9781595937704
• Status: Published
• Refereed: Yes
• Glasgow Author(s) Enlighten ID: Sharma, Mr Oliver and Sventek, Professor Joseph and Girolami, Prof Mark
• Authors: Sharma, O., Girolami, M., and Sventek, J.
• College/School: College of Science and Engineering > School of Computing Science