Novel approch for computer worm detection

Abstract

The spread of computer worms is a nightmare for cyber security officers, which was and still threatens information security, as well as networks infrastructures that contribute and play significant role in economic development and societies growth, and its protection depends on various systems and tools, including “Intrusion Detection Systems”, where its development has become an imperative due to the advancement of computer worm attack techniques and their methods of concealing themselves from been detected. Among the many methods used by researchers in developing intrusion detection systems that are found in the literature, „artificial neural networks‟ were the most used among the machine learning techniques, so they were chosen as a main focus in this study, which we relied on to develop a new model that can detect network anomalies. The training stage of artificial neural networks is considered the basic stage in building the predictive model, there are different algorithms in the literature to get that done, including deterministic methods and stochastic ones, each has its pros and cons. to train our proposed model, we relied, within this study, on the improved 'tree-seed algorithm' which is a nature-inspired algorithm, it‟s used for the first time to optimize a neural network model parameters for detecting network anomalies aiming to get a more accurate model. The proposed model was trained with an improved dataset from its predecessor that was extracted from a simulation of the US Air Force network, and it was evaluated based on the test part, which contains types of attacks that the model has not previously trained on, the results obtained indicate good learning capabilities of the proposed model comparing to the results of two other models based on two stochastic algorithms, namely the 'genetic algorithm' and 'particle swarm optimization '.