Data Mining Tools for Malware Detection

by Mehedy Masud, Latifur Khan, Bhavani Thuraisingham

Although the use of data mining for security and malware detection is quickly on the rise, most books on the subject provide high-level theoretical discussions to the near exclusion of the practical aspects. Breaking the mold, Data Mining Tools for Malware Detection provides a step-by-step breakdown of how to develop data mining tools for malware detection. Integrating theory with practical techniques and experimental results, it focuses on malware detection applications for email worms, malicious code, remote exploits, and botnets. The authors describe the systems they have designed and email worm detection using data mining, a scalable multi-level feature extraction technique to detect malicious executables, detecting remote exploits using data mining, and flow-based identification of botnet traffic by mining multiple log files. For each of these tools, they detail the system architecture, algorithms, performance results, and limitations. From algorithms to experimental results, this is one of the few books that will be equally valuable to those in industry, government, and academia. It will help technologists decide which tools to select for specific applications, managers will learn how to determine whether or not to proceed with a data mining project, and developers will find innovative alternative designs for a range of applications.

450 pages, Hardcover

First published December 1, 2011

Reviews

[Jean-François · Rating 3 out of 5]

A good collection of texts on applying machine learning and AI to various IT security concerns, such as the detection of malicious e-mails, the detection of anomalous behavior in servers or the analysis and correction of firewall rules bases.

The structure is clear, with each section divided into the statement of the problem, the theoretical concepts, the tool developed and the cinclusion.

However, the various typos make certain sections confusing or unpleasant to read. I hope the authors will come with an updated version.

[Muhammad · Rating 1 out of 5]

too academic,
seems like compilation of papers
contains chapters unrealated to
malware, for example, FIREWALL?


less concentration on the data
mining itself.

give me back my money!

[Capcom · Rating 5 out of 5]

awesome book