WhatsApp or SMS: 07087083227
Click here to Get The Complete Research Project Chapter 1-5

Full Project – Developing a model for improved malware detection

Click here to Get this Complete Project Chapter 1-5

CHAPTER ONE

INTRODUCTION

The Internet communication technology brings great convenience to our society. At the same time, a variety of viruses and malicious codes increasingly spread on the network seriously, it brings growing threats to the network.

Among the various forms of malicious software, the Trojan and spyware are most popular in internet. These malwares are always used or programmed by attackers to gain access to private computer systems or gather sensitive information.

Trojan and spyware distinguish themselves from other forms of malware, by that, they have to establish a command and control channel to translate command and data. Most of the current malware detection technology runs on one machine and cannot monitor the network layer effectively.

So such kind of malware detection is not beneficial for detecting the whole local area network (LAN). Some intrusion detection system (IDS)-based network malware

detecting methods, such as Snort, Roesch M et al.(1999). Snort, is based on the communication ports and some other known characteristics.

These methods do not identify or detect the communication behavior. Thus, these methods are sometimes ineffective with the malicious software that changes the ports dynamically and disguise themselves with protocols. They are also not effective for some unknown malicious software newly created.

1.1 Background of the Study

The security of information systems is a serious issue because computer network abuse is on the increase. It is important, therefore, that network administrator, systems analysts and designers develop ingenuity in methods for achieving information systems security. The characteristics found in three generations of general information system design methods provide a framework for comparing and understanding current security design methods. These methods include approaches that use checklist of controls divide functional requirements into engineering partitions and create abstract models of both the problem and the solution comparisons and contrasts revealed that advances in security methods lags behind advance in general systems development methods. The analysis also reveals that more general methods failed to consider security specifications rigorously.

According to information system Audith and control Association ISACA (2006), information security sometimes shortened to infosec, is the practic of defending information from unauthorized access use, disclosure, disruption, modification, persual, inspection, recording or destruction. It is a general term that can be used regardless of the form the data may take (electronic, physical) the field covers all the processes and mechanisms by which computer based equipment information and services are protected from unintended or unauthorized access, change or destruction. Computer security also includes protection from unplanned events and natural disaster. (Security Arcitecture, 2006). The goal of an instrusion detection system is to detect inappropriate, incorrect and unusual activity on a network or on the hosts belonging to a local network by monitoring network activity. To determine if an attack has occured or if one has been attempted typically requires shifting through huge amounts of data (gathering from the network host or file system) looking for clues of suspicious activity. There are two general approaches to this problem signature detection (also known as misuse detection), where one looks for patterns of well-known attacks, and anomaly detection, that looks for deviations from normal behaviour.

Thus, in view of the above, to ensure effective management of an organization network, each department within the organization should be responsible towards developing procedures to implement and enforce a security plan that includes the general security of it’s Information Technology (IT) resources.

The policies and guideline should reflect on the standards and goals of the organization/institution and should address the problems of global networking and other new technologies.

In this project, I present a model malware detection technique with system implementation that overcomes some of the limitations of existing anti-malware approaches. The new technique aims at identifying the internal hosts infected by malwares through inspecting the traffic cross of the border of the whole network. We exploit this new technique with the observation that the malwares share certain characteristics in their network behaviors that are distinct from those of normal software. The proposed technique is based on abstract characteristics of the network behavior of the popular malware and Bayes classification algorithm. (Murphy KP, 2006).

1.2 Statement of the Problem

Evidence from investigation carried out by the researcher reveals that most organizations have lost many vital data/information due to insecurity and malware attack.

The various innovations and techniques which networks are being put are growing by the day and hence are becoming complex and invariably more difficult to manage day by day. Computers are found in every business premises, banks, insurance companies etc. The widespread use of these systems implies crime and insecurity on global scale. In addition, the tremendous benefits brought about by internet have also widened the scope of crime and insecurity at an alarming rate. Also ICT is fast becoming a primary differentiator for institution/organization leaders as it offers effective and convenient means of interaction with each other across the globe. This upsurge is population of organizations depending on ICT for business transaction has brought with it a growing number of security threats and attacks on poorly managed and secured networks primarily to steal personal data, particularly financial information and password. This project, therefore proposes a model malware detection system that should be implemented by network administrators in organization to help them ensure effective network management and security of ICT facilities and data.

1.3 Objectives of the study

The main objective of the study is to develop an improved model of a malware detection system for a network. Specifically, the purposes of the study will be:-

To create a malware detection system that can effectively detect the communication behavior of malicious software on the stages of connection establishment in communications, operating control, and connection maintenance of communications using Bayes classification algorithm
To monitor the network behavior of the collected malware in a honeypot environment

Securing stored information for subsequent usage

Improve the existing security system by ensuring the malware detection system will not only identify known malware but also find new and unknown malware effectively.

1.4 Scope of the study

The operational boundary of this work is particularly on malware attacks on system within the organization cited as the case study. It covers the measures used in order to safeguard information. For this reason a case study was adopted and undertaken and as a result of all interview and correspondents are restricted to this case study for homogeneity and uniformity.

1.5 Significance of the study

We are living in an information engrossed world and the premium placed on information in the digital age has made it to become a previous and an invaluable commodity that all the nation and groups of individuals across the globe are scrambling to get. Since information is now a precious and an indispensable commodity the need to protect the data that are being transmitted becomes mandatory. This study will benefit students in various institutions of higher learning in the country and would also help network administrators secure their organizations’ network. Therefore, enabling organization to save data from malicious attack and unwanted intruders to their network based system.

1.6 Limitation of the study

The major constraint of the study includes time frame, finance and availability of data/resources.

Time frame: Due to the limited time given for the study, the researcher could not visit all the places where data and relevant information to the study could be obtained.
Financial constraint: Considering the high cost of living in the country which also affected the work to some extent. Commercial cities that would have been of interest to this project like Lagos, Abuja, Kaduna, Kano was not visited as a result of the high cost of transportation. These places would have provided an insight on how information security is managed considering the population of the town. This limiting the work areas like Owerri and Port Harcourt.

Availability of data/resources: Due to non-availability of relevant data/resources on this topic, the researcher could not gather much information in this work as required.

1.7 Definition of terms

In the course of this project, the following terms have been found indispensable and will be frequently used. They are:-

Computer: An electronic device that is capable of solving problems by accepting data, performing prescribe operations on the data accepted and supplying the resources of those operations.

Data: Are raw facts and figures, items that are not yet processed.

Information: this is the processed data, facts or details about a particular subject.

Network: Is the interconnection of independent computers, terminals etc such that they can share resources.

Security: security is a degree of resistance to, or protection from harm.

Threat: Is a possible danger that mighty exploit a vulnerability to breach security and thus cause possible harm.

System: A computer whole, a set of things working together as a mechanism or interconnecting network.

Program: Series of coded software instructions to control the operation of a computer.

Software: Set of instructions given to the computer in order to perform a specific task.

Password: A secret word or phrase used to gain access to something (information)

Router: A networking connectivity device that works at the OSI network layer and can link two or more network segments (subnet).

WAN: Wide Area Network is designed to connect LANS together across a data communication equipment network.

Domain Name System (DNS): Is a meaningful and easy to remember handle for an internet addres.

Domain Name: It locates an organization or entity on the internet.

Get the Complete Project

This is a premium project material and the complete research project plus questionnaires and references can be gotten at an affordable rate of N3,000 for Nigerian clients and $8 for international clients.

Click here to Get this Complete Project Chapter 1-5

You can also check other Research Project here: