Applying machine learning techniques for detection of malicious code in network traffic

Yuval Elovici, Asaf Shabtai, Robert Moskovitch, Gil Tahan, Chanan Glezer

KI 2007: Advances in Artificial Intelligence: 30th Annual German Conference …, 2007

The Early Detection, Alert and Response (eDare) system is aimed at purifying Web traffic propagating via the premises of Network Service Providers (NSP) from malicious code. To achieve this goal, the system employs powerful network traffic scanners capable of cleaning traffic from known malicious code. The remaining traffic is monitored and Machine Learning (ML) algorithms are invoked in an attempt to pinpoint unknown malicious code exhibiting suspicious morphological patterns. Decision trees, Neural Networks and Bayesian Networks are used for static code analysis in order to determine whether a suspicious executable file actually inhabits malicious code. These algorithms are being evaluated and preliminary results are encouraging.