Early Worm Detection for Minimizing Damage in E-Service Networks

Abstract

One of the most powerful weapons for attackers is the Internet worm. Specifically, a worm attacks vulnerable computer systems and employs self-propagating methods to flood the Internet rapidly. Since a “Worm” is self-propagated through the connected network, it doesn’t need human interaction or file transmission to replicate itself. It spreads in minutes; Slammer worms infect about 75,000 nodes through the internet in about 10 minutes. Since most of antivirus programs detect viruses based on their signature, then this approach can’t detect new viruses or worms till being updated with their signature, which can’t be known unless some systems had already been infected. This highlights worms are still on the top of malware threats attacking computer systems, although the evolution of worms detection techniques. Early detection of unknown worms is still a problem. This chapter produce a method for detecting unknown worms based on local victim information. The proposed system uses Artificial Neural Network (ANN) for classifying worm/ nonworm traffic and predicting the percentage of infection in the infected network. This prediction can be used to support decision making processes for network administrators to respond quickly to worm propagation in an accurate procedure.