Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

Email worm detection by wavelet analysis of DNS query streams

: Chatzis, N.; Popescu-Zeletin, R.; Brownlee, N.


IEEE Computational Intelligence Society:
CICS 2009, IEEE Symposium on Computational Intelligence in Cyber Security : Nashville, Tennessee, USA, 30 march - 2 april 2009
New York, NY: IEEE, 2009
ISBN: 978-1-4244-2769-7
Symposium on Computational Intelligence in Cyber Security (CICS) <2009, Nashville/Tenn.>
Conference Paper
Fraunhofer FOKUS ()
DNS; email worm; detection; wavelet

The high prevalence of email worms indicates that current in-network defence mechanisms are incapable of mitigating this Internet threat. Moreover, commonly applied approaches against this class of propagating malicious program do not target reducing unwanted email traffic traversing the Internet. In this paper, we take a step toward better understanding of email worms, and explore their effect on the flow-level characteristics of domain name system (DNS) query streams that user machines generate. We propose a novel method, which uses time series analysis and unsupervised learning, to detect email worms as they appear on local name servers. To evaluate our detection method, we have constructed a DNS query dataset that consists of 71 email worms. We demonstrate that our method is very effective.