Internet Worm Detection and Classification Based on Support Vector Machine

摘要: This paper proposes a novel Internet worm detection and classification method. The behaviors of worms are different from each other’s, they also in terms the normal activities. So we can detect classify by extracted features network packets. At first, sniff raw packets local area (LAN), extract 13 packet header, then select 10 important using information gain algorithm. With labeled features, train Support Vector Machine (SVM) classifiers. classifiers apart And this approach attacks worms, although have similar behaviors. In experiments, performs well classification.