Bibliographic Details
| Title: |
NADTW: new approach for detecting TCP worm. |
| Authors: |
Anbar, Mohammed1 anbar@nav6.usm.my, Abdullah, Rosni rosni@usm.my, Munther, Alhamza2 alhamza.munther@gmail.com, Al-Betar, Mohammed3 mohbetar@cs.usm.my, Saad, Redhwan1 redhwan@nav6.usm.my |
| Source: |
Neural Computing & Applications. Dec2017 Supplement 1, Vol. 28, p525-538. 14p. |
| Subjects: |
Computer worms, Malware, Intrusion detection systems (Computer security), Computer network security, TCP/IP, Bandwidths |
| Abstract: |
A computer worm is a self-replicating malicious code that does not alter files but resides in active memory where it duplicates itself. Worms use parts of the operating system that are automatic and usually invisible to the user. Worms commonly exhibit abnormal behaviors, which become noticeable only when their uncontrolled replication consumes system resources and consequently decelerates or halts other tasks completely. This paper proposes an effective approach for detecting the presence of TCP network worms. This approach consists of two phases: Statistical Cross-relation for Network Scanning (SCANS) phase and the Worm Correlation phase. The SCANS phase is used to detect the presence of the network scanning behavior of a network worm, while the worm correlation phase is used to detect the Destination Source Correlation (DSC) behavior of the network worm. The proposed approach has been tested with a simulated dataset obtained from the GTNetS simulator. The numerical results showed that the proposed approach is efficient and outperforms the well-known DSC approach in terms of detecting the presence of TCP network worm. [ABSTRACT FROM AUTHOR] |
|
Copyright of Neural Computing & Applications is the property of Springer Nature and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) |
| Database: |
Engineering Source |
