Abstract:

A host usually changes its network traffic characteristics when infected by a worm. From the observation, a worm detection method was proposed. It drew inspiration from the negative selection of the immune system. Firstly, V-detector algorithm—a real-valued negative selection algorithm with variable-coverage detectors was improved. The improved algorithm endeavored to generate large detectors according to the non-self space distribution. Compared with V-detector, the improved algorithm generated a much smaller detector set and increased the detection efficiency. Secondly, the improved V-detector algorithm was used to generate detector sets and monitor hosts’ network traffic characteristics for worm attacks. Experiments show that the method is effective to detect traditional worms as well as multi-vector polymorphic worms.

Key words: artificial immune system, negative selection, worm detection