TU Berlin

Internet Network ArchitecturesAll Publications

Page Content

to Navigation

All publications

Email Worm Detection by Wavelet Analysis of DNS Query Streams
Citation key CPB-EWDWADQS-09
Author Chatzis, Nikolaos and Popescu-Zeletin, Radu and Brownlee, Nevil
Title of Book Proceedings of the IEEE Symposium on Computational Intelligence in Cyber Security (CICS '09)
Pages 53–60
Year 2009
DOI http://dx.doi.org/10.1109/CICYBS.2009.4925090
Address New York, NY, USA
Publisher IEEE
Abstract The high prevalence of email worms indicates that current in-network defence mechanisms are incapable of mitigating this Internet threat. Moreover, commonly applied approaches against this class of propagating malicious program do not target reducing unwanted email traffic traversing the Internet. In this paper, we take a step toward better understanding of email worms, and explore their effect on the flow-level characteristics of domain name system (DNS) query streams that user machines generate. We propose a novel method, which uses time series analysis and unsupervised learning, to detect email worms as they appear on local name servers. To evaluate our detection method, we have constructed a DNS query dataset that consists of 71 email worms. We demonstrate that our method is very effective.
Download Bibtex entry


Quick Access

Schnellnavigation zur Seite über Nummerneingabe