Hybrid Worm Detection Based on Signature & Anomaly

Internet worms pose a significant threat by propagating through network traffic, compromising system security, and exfiltrating sensitive information. To enhance detection accuracy, a hybrid two-factor worm detection system is proposed, integrating signature-based and anomaly-based methodologies. Signature-based detection employs packet capture (PCAP) analysis and NetFlow inspection to identify malicious signatures using predefined rule sets. Honeypot logs are leveraged to detect and mitigate attack attempts by monitoring unauthorized access attempts. Anomaly-based detection utilizes machine learning models, including Random Forest, Decision Tree, and Bayesian Networks, to classify network traffic as normal or abnormal based on behavioral patterns. Experimental results demonstrate that Random Forest and Decision Tree achieve the highest accuracy of 98%, outperforming Bayesian Networks. Additionally, deep learning models such as Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM), and Gated Recurrent Units (GRU) are employed for anomaly detection, with GRU achieving superior performance. The proposed framework effectively enhances worm detection capabilities, reducing false positives and improving cybersecurity resilience. Future enhancements include integrating evolutionary feature selection techniques such as Genetic Algorithms and Particle Swarm Optimization to optimize detection accuracy.