Fast and Effective Worm Fingerprinting via Machine Learning

— As Internet worms become ever faster and more sophisticated, it is important to be able to extract worm signatures in an accurate and timely manner. In this paper, we apply machine learning to automatically fingerprint polymorphic worms, which are able to change their appearance across every instance. Using real Internet traces and synthetic polymorphic worms, we evaluated the performance of several advanced machine learning algorithms, including naive Bayes, decision-tree induction, rule learning (RIPPER), and support vector machines. The results are very promising. Compared with Polygraph, the state of the art in polymorphic worm fingerprinting, several machine learning algorithms are able to generate more accurate signatures, tolerate more noise in the training data, and require much shorter training time. These results open the possibility of applying machine learning to build a fast and accurate online worm fingerprinting system.

• Type: Conference
• Year: 2006
• Where: ICAC
• Authors: Stewart M. Yang, Jianping Song, Harish Rajamani, Tae Won Cho, Yin Zhang, Raymond J. Mooney
• Keywords: Autonomic Computing, ICAC 2006, Machine Learning, Machine Learning Algorithms, Polymorphic Worm