Email worm detection by wavelet analysis of DNS query streams

The high prevalence of email worms indicates that current in-network defence mechanisms are incapable of mitigating this Internet threat. Moreover, commonly applied approaches against this class of propagating malicious program do not target reducing unwanted email traffic traversing the Internet. I...

Full description

Saved in:
Bibliographic Details
Main Authors: Chatzis, N., Popescu-Zeletin, R., Brownlee, N.
Format: Conference Proceeding
Language:English
Subjects:
Character generation
Computer worms
Domain Name System
Humans
Internet
Telecommunication traffic
Time series analysis
Unsupervised learning
Wavelet analysis
Web server
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:The high prevalence of email worms indicates that current in-network defence mechanisms are incapable of mitigating this Internet threat. Moreover, commonly applied approaches against this class of propagating malicious program do not target reducing unwanted email traffic traversing the Internet. In this paper, we take a step toward better understanding of email worms, and explore their effect on the flow-level characteristics of domain name system (DNS) query streams that user machines generate. We propose a novel method, which uses time series analysis and unsupervised learning, to detect email worms as they appear on local name servers. To evaluate our detection method, we have constructed a DNS query dataset that consists of 71 email worms. We demonstrate that our method is very effective.
DOI:10.1109/CICYBS.2009.4925090