Detection System for Detecting Worms using Hybrid Algorithm of Naïve Bayesian classifier and K-Means

According to a huge rampage of malware attacks especially worms which the attackers use in their attacks to the network. Detection systems are needed to stop these worm attacks. In this paper, we proposed and designed a detection system that detects worms depending on a dataset was taken from tow web sites which are the Kasperski web site and the McAfee web site, these two companies' websites links are: (https://www.kaspersky.com/resource-center/threats/resource-for-virus-threats-definitions, https://home.mcafee.com/virusinfo). The information of the worms that had been used in this paper and had been detected by the detection system were all from this data set that had been gathered from these two websites the Kasperski and McAfee. The proposed system has been used in host-based environment and it consists of two hybrid algorithms, which are the Naïve Bayesian classification and K-Means clustering and called NBKM. The proposed NBKM is a hybrid between Naïve Bayesian classification and K-Means clustering, which they are both Data mining and Machine learning techniques. This hybrid model has the benefits of the two algorithms the Naïve Bayesian classification and the K-Means clustering, the data detection could be achieved by two phases, which are classification and clustering. The NB classifier was used to make a comparison among the results with the previous proposed model NBKM to check the NBKM model performance. In addition, as the previous model, it will classify the data of incoming packets as ones and zeros, the ones for the threat data and the zeros for the benign, and it would check the ports that would the worm could get access to the network with the local IP address (127.0.0.1). We applied this proposed algorithm on the dataset that involves the worms and as a result, we gained 88% accuracy, 81% of Detection Rate and 21% of False Alerts.