Adaptive Worms Detection Model Based on Multi Classifiers

Abstract

In recent times, the networks security has become a place of interest of researchers, threats has become an issue for each networks system, and a source of concern. Worms attacks have been major security threats to networks and the internet, which are cause many of problems. Using traditional approaches "misuse detection" to detect worms through their signatures unable to detect unknown worms before the appearance of their signatures. So Detecting worms, especially new and unknown worms is still a challenging task. The focus of worm detection research is shifting from using misuse detection " signature patterns " to anomaly detection " identifying the malicious behavior ". In addition standalone anomaly classifiers used by anomaly worms detection systems are unable to access acceptable accuracies in real-world deployments. Therefore, the combination method is particularly useful for difficult problems, and to achieve higher accuracies and detection rates, and rising classification error. In this research, we proposed using data mining techniques by combination of classifiers (Naïve Bayes, Decision Tree, and Artificial Neural Network) as in multi classifiers to be able adaptive for detecting known/ unknown worms depend on behavior-anomaly detection approach, to achieve higher accuracies and detection rate, and lower classification error rate. The results show that the proposed model has achieved higher accuracies and detection rates of classification, where detection known worms are at least 98.30%, with classification error rate 1.30%, while the unknown worm detection rate is about 98.05%, with classification error rate 1.95%.