Predicting the Presence of Internet Worms using Novelty Detection

2007/05/09 by E. Marais, T. Marwala, Marais, E. +1
Computer Science · #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #cs.CR

paper · pdf · doi:10.48550/arxiv.0705.1288

12 pages

arxiv created 2007/05/09 · arxiv updated 2009/12/01

Abstract

Internet worms cause billions of dollars in damage yearly, affecting millions of users worldwide. For countermeasures to be deployed timeously, it is necessary to use an automated system to detect the spread of a worm. This paper discusses a method of determining the presence of a worm, based on routing information currently available from Internet routers. An autoencoder, which is a specialized type of neural network, was used to detect anomalies in normal routing behavior. The autoencoder was trained using information from a single router, and was able to detect both global instability caused by worms as well as localized routing instability.

Related

• Modeling and Automated Containment of Worms
• Self-Disciplinary Worms and Countermeasures: Modeling and Analysis
• ARCADE: Adversarially Regularized Convolutional Autoencoder for Network Anomaly Detection
• AI Agents Enable Adaptive Computer Worms
• Darknet-Based Inference of Internet Worm Temporal Characteristics