Automatic signature generation for polymorphic worms by combination of token extraction and sequence alignment approaches

Abstract

As modern worms spread quickly; any countermeasure based on human reaction is barely fast enough to thwart the threat. Moreover, because polymorphic worms could generate mutated instances, they are more complex than non-mutating ones. Currently, the content-based signature generation of polymorphic worms is a challenge for network security. Several signature classes have been proposed for polymorphic worms. Although previously proposed schemes consider patterns such as I-byte invariants and distance restrictions, they could not handle neither large payloads nor the big size pool of worm instances. Moreover, they are prone to noise injection attack. We proposed a method to combine two approaches of creating a polymorphic worm signature in a new way that avoid the limitation of both approaches. The proposedsignature generation scheme is based on token extraction and multiple sequence alignment, widely used in Bioinformatics. This approach provides speed, accuracy, and flexibility in terms of noise tolerance. The evaluations demonstrate these claims.

A Worm Detection System Based on Deep Learning

“…Mondal et al [6] declared an automatic method that will generate signatures for the detection of polymorphic worms, and they applied Principal Component Analysis (PCA) for determining the critical substrings that appear mostly and are pooled amongst the instances of polymorphic worms for using them as signatures. Eskandari et al [7] proposed a signature generation scheme based on token extraction and multiple sequence alignment. However, these methods are usually based on the features manually presented, and then design an algorithm to detect worms.…”