Abstract
This work focuses on applying data mining techniques to detect email worms. We apply a feature-based detection technique. These features are extracted using different statistical and behavioral analysis of emails sent over a certain period of time. The number of features thus extracted is too large. So, our goal is to select the best set of features that can efficiently distinguish between normal and viral emails using classification techniques. First, we apply Principal Component Analysis (PCA) to reduce the high dimensionality of data and to find a projected, optimal set of attributes. We observe that the application of PCA on a benchmark dataset improves the accuracy of detecting novel worms. Second, we apply J48 decision tree algorithm to determine the relative importance of features based on information gain. We are able to identify a subset of features, along with a set of classification rules that have a better performance in detecting novel worms than the original set of features or PCA-reduced features. Finally, we compare our results with published results and discuss our future plans to extend this work.
Keywords
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Martin, S., et al.: A Two-Layer Approach for Novel Email Worm Detection. Submitted to USENIX SRUTI (Steps on Reducing Unwanted Traffic on the Internet) (2005)
WEKA: Data Mining Software in Java. http://www.cs.waikato.ac.nz/~ml/weka/
Quinlan, J.R.: C4.5: Programs for Machine Learning. Morgan Kaufmann, San Francisco (1993)
Golbeck, J., Hendler, J.: Reputation network analysis for email filtering. In: CEAS (2004)
Newman, M.E.J., Forrest, S., Balthrop, J.: Email networks and the spread of computer viruses. Physical Review E 66, 35101 (2002)
Symantec Corporation. W32.Beagle.BG. Online (2005), http://www.sarc.com/avcenter/venc/data/w32.beagle.bg@mm.html
Schultz, M., Eskin, E., Zadok, E.: MEF: Malicious email filter, a UNIX mail filter that detects malicious windows executables. In: USENIX Annual Technical Conference - FREENIX Track (June 2001)
Singh, S., et al.: The EarlyBird System for Real-time Detection of Unknown Worms. Technical report - cs2003-0761, UCSD (2003)
Kim, H.-A., Karp, B.: Autograph: Toward Automated, Distributed Worm Signature Detection. In: Proceedings of the 13th Usenix Security Symposium (Security 2004), San Diego, CA (August 2004)
Newsome, J., Karp, B., Song, D.: Polygraph: Automatically Generating Signatures for Polymorphic Worms. In: Proceedings of the IEEE Symposium on Security and Privacy, May 2005, IEEE Computer Society Press, Los Alamitos (2005)
Honeypot. http://www.honeypots.net/
Martin, S., et al.: Analyzing Behavioral Features for Email Classification. In: Proceedings of the IEEE Second Conference on Email and Anti-Spam (CEAS 2005), Stanford University, July 21-22, 2005, IEEE Computer Society Press, Los Alamitos (2005)
Sidiroglou, S., et al.: An Email Worm Vaccine Architecture. In: Deng, R.H., et al. (eds.) ISPEC 2005. LNCS, vol. 3439, Springer, Heidelberg (2005)
Mitchell, T.: Machine Learning. McGraw-Hill, New York (1997)
John, G.H., Langley, P.: Estimating Continuous Distributions in Bayesian Classifiers. In: Proceedings of the Eleventh Conference on Uncertainty in Artificial Intelligence, pp. 338–345. Morgan Kaufmann, San Mateo (1995)
Boser, B.E., Guyon, I.M., Vapnik, V.N.: A training algorithm for optimal margin classifiers. In: Haussler, D. (ed.) 5th Annual ACM Workshop on COLT, Pittsburgh, PA, pp. 144–152. ACM Press, New York (1992)
A library for Support Vector Machine: http://www.csie.ntu.edu.tw/~cjlin/libsvm/
Author information
Authors and Affiliations
Editor information
Rights and permissions
Copyright information
© 2007 Springer Berlin Heidelberg
About this paper
Cite this paper
Masud, M.M., Khan, L., Thuraisingham, B. (2007). Feature Based Techniques for Auto-Detection of Novel Email Worms. In: Zhou, ZH., Li, H., Yang, Q. (eds) Advances in Knowledge Discovery and Data Mining. PAKDD 2007. Lecture Notes in Computer Science(), vol 4426. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-71701-0_22
Download citation
DOI: https://doi.org/10.1007/978-3-540-71701-0_22
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-71700-3
Online ISBN: 978-3-540-71701-0
eBook Packages: Computer ScienceComputer Science (R0)