A new model for worm detection and response. Development and evaluation of a new model based on knowledge discovery and data mining techniques to detect and respond to worm infection by integrating incident response, security metrics and apoptosis.

摘要

Worms have been improved and a range of sophisticated techniques have beenudintegrated, which make the detection and response processes much harder andudlonger than in the past. Therefore, in this thesis, a STAKCERT (Starter Kit forudComputer Emergency Response Team) model is built to detect worms attack inudorder to respond to worms more efficiently.udThe novelty and the strengths of the STAKCERT model lies in the methodudimplemented which consists of STAKCERT KDD processes and theuddevelopment of STAKCERT worm classification, STAKCERT relational modeludand STAKCERT worm apoptosis algorithm. The new concept introduced in thisudmodel which is named apoptosis, is borrowed from the human immunologyudsystem has been mapped in terms of a security perspective. Furthermore, theudencouraging results achieved by this research are validated by applying theudsecurity metrics for assigning the weight and severity values to trigger theudapoptosis. In order to optimise the performance result, the standard operatingudprocedures (SOP) for worm incident response which involve static and dynamicudanalyses, the knowledge discovery techniques (KDD) in modeling theudSTAKCERT model and the data mining algorithms were used.udThis STAKCERT model has produced encouraging results and outperformedudcomparative existing work for worm detection. It produces an overall accuracyudrate of 98.75% with 0.2% for false positive rate and 1.45% is false negative rate.udWorm response has resulted in an accuracy rate of 98.08% which later can beudused by other researchers as a comparison with their works in future.