<XML><RECORDS><RECORD><REFERENCE_TYPE>3</REFERENCE_TYPE><REFNUM>8738</REFNUM><AUTHORS><AUTHOR>Sharma,O.</AUTHOR><AUTHOR>Girolami,M.</AUTHOR><AUTHOR>Sventek,J.S.</AUTHOR></AUTHORS><YEAR>2007</YEAR><TITLE>Detecting Worm Variants using Machine Learning</TITLE><PLACE_PUBLISHED>Proceedings of the 3rd International Conference on emerging Networking EXperiments and Technologies (CoNEXT), New York, NY, USA, December 2007</PLACE_PUBLISHED><PUBLISHER>ACM</PUBLISHER><LABEL>Sharma:2007:8738</LABEL><KEYWORDS><KEYWORD>Network intrusion detection; Machine Learning; Worms</KEYWORD></KEYWORDS<ABSTRACT>Network intrusion detection systems typically detect worms by examining packet or flow logs for known signatures. Not only does this approach mean worms cannot be detected until the signatures are created, but that variants of known worms will remain undetected since they will have different signatures. The intuitive solution is to write more generic signatures. This solution, however, would increase the false alarm rate and is therefore practically not feasible. This paper reports on the feasibility of using a machine learning technique to detect variants of known worms in real-time. Support vector machines (SVMs) are a machine learning technique known to perform well at various pattern recognition tasks, such as text categorization and handwritten digit recognition. Given the efficacy of SVMs in standard pattern recognition problems this work applies SVMs to the worm detection problem. Specifically, we investigate the optimal configuration of SVMs and associated kernel functions to classify various types of synthetically generated worms. We demonstrate that the optimal configuration for real time detection of variants of known worms is to use a linear kernel, and unnormalized bi-gram frequency counts as input.</ABSTRACT></RECORD></RECORDS></XML>