A novel method for network worm detection based on wavelet packet analysis
- Author:
Mingtao LIAO
1
Author Information
1. Institute of Network
- Publication Type:Journal Article
- From:Academic Journal of Xi'an Jiaotong University
2006;18(2):97-101
- CountryChina
- Language:Chinese
-
Abstract:
Objective: To detect unknown network worm at its early propagation stage. Methods: On the basis of characteristics of network worm attack, the concept of failed connection flow (FCT) was defined. Based on wavelet packet analysis of FCT time series, this method computed the energy associated with each wavelet packet of FCT time series, transformed the FCT time series into a series of energy distribution vector on frequency domain, then a trained K-nearest neighbor (KNN) classifier was applied to identify the worm. Results: The experiment showed that the method could identify network worm when the worm started to scan. Compared to theoretic value, the identification error ratio was 5.69%. Conclusion: The method can detect unknown network worm at its early propagation stage effectively.
