Deep Learning CNN Framework for Detection and Classification of Internet Worms

Abstract

A worm is a standalone program, which is self-replicating malware that distributes itself to other computers and networks. An Internet worm can spread across the network and infect millions of computers in truly little time and the damages caused from such attacks are considered extremely high. In addition, these worms also affect the network packet and its performance, where the packets are analyzed by the signature-based intrusion detection system (IDS) and the network performance is analyzed by the NetFlow based IDS. Hence, this article proposes a joint detection of both the signature based and NetFlow based Internet worms using deep learning convolution neural network (DLCNN) with respect to various attacks and it can also prevent the suspicious actions of attackers (cyber-criminals). Additionally, it provides the security for users’ data maintenance, countermeasures, and controls the spreading of the internet worms. The effectiveness of proposed DLCNN model is evaluated using both packet capture (PCAP) and KDD-CUP-99 datasets. Finally, various quality metrics are employed to disclose the superiority of proposed DLCNN model as compared existing machine learning, and back propagated neural network models.