Bhavani Thuraisingham Knihy

While the use of data mining for security and malware detection is increasing, many resources focus primarily on theoretical discussions, often neglecting practical applications. This book breaks that trend by offering a detailed guide on developing data mining tools specifically for malware detection. It combines theoretical insights with practical techniques and experimental findings, addressing malware detection for email worms, malicious code, remote exploits, and botnets. The authors present the systems they have created, including methods for email worm detection, a scalable multi-level feature extraction technique for identifying malicious executables, and flow-based identification of botnet traffic through log file mining. Each tool is accompanied by a thorough explanation of system architecture, algorithms, performance results, and limitations. The text also explores emerging applications of data mining, such as adaptable malware detection and insider threat detection, and includes four appendices that cover data management, secure systems, and the semantic web. This resource is invaluable for industry professionals, government officials, and academics, guiding technologists in tool selection, helping managers evaluate data mining projects, and providing developers with innovative design alternatives across various applications.