A data mining approach for analysis of worm activity through automatic signature generation

This paper proposes a novel framework to automatically discover and analyze traffc generated by computer worms and other anomalous behaviors that interact with a non-solicited traffc monitoring system. Network packets are analyzed by an Intrusion Detection System (IDS), and new signatures are generated clustering those which remain unknown for the IDS. Furthermore, the framework provides a mechanism to cluster the alarms produced by the IDS producing a correlated vision of the traffc observed. Both the automatic signature generation and the alarm clusters are accomplished using data mining techniques. © 2009 IEEE.