Detection Ofunknowncomputer WormsActivity Basedon Computer Behavior Using DataMining

Detecting unknownwormsisachallenging task. Extant solutions, suchasanti-virus tools, relymainly onprior explicit knowledge ofspecific wormsignatures. Asa result, after theappearance ofa newwormontheWeb thereisa significant delay until anupdate carrying theworm'ssignature isdistributed toanti-virus tools. During this timeinterval anew wormcaninfect manycomputers andcausesignificant damage. We propose aninnovative technique fordetecting thepresence ofanunknownworm,notnecessarily byrecognizing specific instances oftheworm,butrather basedonthecomputer measurements. We designed anexperiment totestthenew technique employing several computerconfigurations and background applications activity. During theexperiments 323 computerfeatures weremonitored. Fourfeature selection techniques wereusedtoreduce theamountoffeatures andfour classification algorithms wereapplied ontheresulting feature subsets. Ourresults indicate thatusing this approach resulted inexceeding 90% meanaccuracy, andforspecific unknown wormsaccuracy reached above99%,using just20features while maintaining alowlevel offalse positive rate.