Differencing worm flows and normal flows for automatic generation of worm signatures

Kumar Simkhada, Hiroshi Tsunoda, Yuji Waizumi, Yoshiaki Nemoto

Research output: Chapter in Book/Report/Conference proceedingConference contribution

6 Citations (Scopus)

Abstract

Internet worms pose a serious threat to networks. Most current Intrusion Detection Systems (IDSs) take signature matching approach to detect worms. Given the fact that most signatures are developed manually, generating new signatures for each variant of a worm incurs significant overhead. In this paper, we propose a difference-based scheme which differences worm flows and normal flows to generate robust worm signatures. The proposed scheme is based on two observational facts - worm flows contain several invariant portions in their payloads, and core worm codes do not exist in normal flows. It uses samples of worm flows detected by available means to extract common tokens. It then differences the set of these tokens with those of normal flows and generates signature candidates. By using such signatures within enterprises, out of reach of worm writers, the possibility of being tricked by worm writers can be reduced. We evaluate the proposed scheme using real network traffic traces that contains worms. Experiment results show that the proposed scheme exhibits high detection rate with low false positives.

Original languageEnglish
Title of host publicationProceedings - Seventh IEEE International Symposium on Multimedia, ISM 2005
Pages680-685
Number of pages6
DOIs
Publication statusPublished - 2005 Dec 1
EventSeventh IEEE International Symposium on Multimedia, ISM 2005 - Irvine, CA, United States
Duration: 2005 Dec 122005 Dec 14

Publication series

NameProceedings - Seventh IEEE International Symposium on Multimedia, ISM 2005
Volume2005

Other

OtherSeventh IEEE International Symposium on Multimedia, ISM 2005
CountryUnited States
CityIrvine, CA
Period05/12/1205/12/14

ASJC Scopus subject areas

  • Engineering(all)

Fingerprint Dive into the research topics of 'Differencing worm flows and normal flows for automatic generation of worm signatures'. Together they form a unique fingerprint.

Cite this