Improving Worm Detection With Artificial Neural Networks Through Feature Selection and Temporal Analysis Techniques
Computer worm detection is commonly performed by antivirus software tools that rely on prior explicit knowledge of the worm's code (detection based on code signatures). The authors present an approach for detection of the presence of computer worms based on Artificial Neural Networks (ANN) using the computer's behavioral measures. Identification of significant features, which describe the activity of a worm within a host, is commonly acquired from security experts. They suggest acquiring these features by applying feature selection methods. They compare three different feature selection techniques for the dimensionality reduction and identification of the most prominent features to capture efficiently the computer behavior in the context of worm activity. Additionally, they explore three different temporal representation techniques for the most prominent features.