ERES: an extended regular expression signature for polymorphic worm detection

Eskandari, Razieh; Shajari, Mahdi; Ghahfarokhi, Mojtaba Mostafavi

doi:10.1007/s11416-019-00330-1

Cited by 7 publications

(4 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Eskandari et al remedied the aforementioned issues and proposed an extended regular expression signature extraction method, referred to as ERES. 23 However, the signature generation system of polymorphic worm based on regular expression matching is complicated in designing, and the traditional matching algorithm needs to adjust when it is used in variants of polymorphic worms.…”

Section: Simplified-regular-expression-based Signature Generationmentioning

confidence: 99%

“…In the face of appearance changes of polymorphic worms, the smoothing N-gram algorithm can partially infer their appearance, so it can extract deep-hidden worm sequences, preventing the invasion of polymorphic worms. To verify the effectiveness of our proposed system model, we compare it with the works of References [16,23,33], and the findings are summarized in Table 6.…”

Section: Signature Generation Under Noisy Conditionmentioning

confidence: 99%

“…Their method takes the distance constraint of polymorphic worm traffic sequences into consideration and generates separate signatures for different polymorphic worms, which leads to low efficiency and a high false‐negative rate in detecting polymorphic worms. Eskandari et al remedied the aforementioned issues and proposed an extended regular expression signature extraction method, referred to as ERES 23 . However, the signature generation system of polymorphic worm based on regular expression matching is complicated in designing, and the traditional matching algorithm needs to adjust when it is used in variants of polymorphic worms.…”

Section: Related Workmentioning

confidence: 99%

“…To better describe the principle of the N‐ gram algorithm, we follow the functions and notations of Reference [23] throughout this paper. Let us take the Apache‐knacker worm as an example.…”

Section: An Automated Signature Generation System For Polymorphic Wormmentioning

confidence: 99%

See 3 more Smart Citations

Toward machine intelligence that learns to fingerprint polymorphic worms in IoT

Wang

Yang

Wang

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

Internet of Things (IoT) is fast growing. Non-personal computer devices under the umbrella of IoT have been increasingly applied in various fields and will soon account for a significant share of total Internet traffic. However, the security and privacy of IoT and its devices have been challenged by malware, particularly polymorphic worms that rapidly selfpropagate once being launched and vary their appearance over each infection to escape from the detection of signature-based intrusion detection systems. It is well recognized that polymorphic worms are one of the most intrusive threats to IoT security.To build an effective, strong defense for IoT networks against polymorphic worms, this study proposes a machine intelligent system, termed Gram-Restricted Boltzmann Machine (Gram-RBM), which automatically generates generic fingerprints/signatures for the polymorphic worm. Two augmented N-gram-based methods are designed and applied in the derivation of polymorphic worm sequences, also known as fingerprints/signatures. These derived sequences are then optimized using the Gaussian-Bernoulli RBM dimension-reduction algorithm. The results, gained

show abstract

Section: Simplified-regular-expression-based Signature Generationmentioning

confidence: 99%

Section: Signature Generation Under Noisy Conditionmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: An Automated Signature Generation System For Polymorphic Wormmentioning

confidence: 99%

See 2 more Smart Citations