A Model for Computer Worm Detection in a Computer Network

This research presents a novel approach to detecting computer worms in Computer Networks by making use of detection based on the network behavior through the collection of various parameters such as: network latency, throughput, bandwidth, response time, network utilization, packet loss and reliability. Infected hosts were tracked using an algorithm developed. Documentation of network measurements (behavior) metrics for the purpose of detecting unknown worm infection using instance-based technique was achieved by taking note of the changes in the network parameters and their values were logged in the database, as worm propagated through the network. a model for calculating network performance characteristic was developed. Network Worm Simulator (NWS) was used to perform the scanning activities of worms on the network. Jpcap was used to captured network packet. In the database model, the Packets table store network packet captured, the time of capture and every packets stored is given a unique number as id. The network_metric table store the network parameter values for the packets identified by Packet_id related to the Packets table, each set of network parameter value is identified by a unique number called ID. The simulation of the model was implemented using Java programming language.