A new approach for internet worm detection and classification

To detect internet worm, many academic approaches have been proposed. In this paper, we provide a new approach to detect internet worm. We consider behaviors of internet worm that is different from the normal pattern of internet activities. We consider all network packets before they reach to the end-user by extracting a certain number of features of internet worm from these packets. Our network features mainly consist of characteristics of IP address, port, protocol and some flags of packet header. These features are used to detect and classify behavior of internet worm by using 3 different data mining algorithms which are Bayesian Network, Decision Tree and Random Forest. In addition, our approach not only can classify internet worm apart from the normal data, but also can classify network attacks that have similar behaviors to the internet worm behaviors. Our approach provides good results with detection rate over 99.6 percent and false alarm rate is close to zero with Random forest algorithm. In addition, our model can classify behaviors of DoS and Port Scan attacks with detection rate higher than 98 percent and false alarm rate equal to zero.