Internet worms identification through serial episodes mining

An Internet worm is a typical Internet attack that can rapidly pervade a computer without user intervention. In the frequent episodes mining, data is regarded as a sequence of events, where each event has an associated time of occurrence, thus, it has significant effect on the discovery of sophisticated Internet attacks. The method proposed in this paper can be used to detect abnormal Internet episodes from the log files of a honeypot system in order to discover known or unknown attack episodes. The experiment successfully identified sophisticated Internet attack episodes, which were caused by Internet worms, such as Sasser, Shelp, Korgo, etc.