PC Worm Detection System Based on the Correlation between User Interactions and Comprehensive Network Behaviors

Abstract

SUMMARYAnomaly-based worm detection is a complement to existing signature-based worm detectors. It detects unknown worms and fills the gap between when a worm is propagated and when a signature is generated and downloaded to a signature-based worm detector. A major obstacle for its deployment to personal computers (PCs) is its high false positive alarms since a typical PC user lacks the skill to handle exceptions flagged by a detector without much knowledge of computers. In this paper, we exploit the feature of personal computers in which the user interacts with many running programs and the features combining various network characteristics. The model of a program's network behaviors is conditioned on the human interactions with the program. Our scheme automates detection of unknown worms with dramatically reduced false positive alarms while not compromising low false negatives, as proved by our experimental results from an implementation on Windows-based PCs to detect real world worms.

Security Data Collection and Data Analytics in the Internet: A Survey

“…Some works used the features such as packet rate, packet arrival time, packet size, payload, etc., to detect worms in their transferring phase [132-135, 137, 138, 140, 145-147, 153]. Host-level data are used in conjunction with packet-level and flow-level data because worms are malicious programs that directly execute at host-side [138,140]. Each kind of worms has different reflecting characteristics.…”

“…BINDER's detection method is incapable of detecting unknown worms and can be evaded by attackers with fake user events or infected normal programs. Seo et al [140] designed an improved detection method called PC-WDS based on the extend ideas proposed in BINDER. It applies sophisticated features to improve detection accuracy while reducing false alarms.…”