An Automatic Signature-Based Approach for Polymorphic Worms in Big Data Environment

Wang, Fangwei; Yang, Shaojie; Zhao, Dongmei; Wang, Chang-Guang

doi:10.1109/nana.2019.00047

Cited by 1 publication

(1 citation statement)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Paweł Szynkiewicz et al [16] developed an efficient algorithm for token extraction and a novel method for automatic multi-token signature composition. Fangwei Wang et al [17] proposed an automatic signature extraction algorithm for polymorphic worms based on the improved Term Frequency-Inverse Document Frequency (TF-IDF). Yehuda Afek et al [18] presented a basic tool for zero-day attack signature extraction.…”

Section: Related Workmentioning

confidence: 99%

A Worm Detection System Based on Deep Learning

Zhou

Yang

et al. 2020

IEEE Access

View full text Add to dashboard Cite

In today's cyber world, worms pose a great threat to the global network infrastructure. In this paper, we propose a worm detection system based on deep learning. It includes two main modules: one worm detection module based on a convolutional neural network (CNN) and one automatic worm signature generation module based on a deep neural network (DNN). In the CNN-based worm detection module, we propose three kinds of data preprocessing methods: frequency processing, frequency weighted processing, and difference processing, and use CNN to train the model for worm detection. In the DNN-based worm signature generation module, there are two phrase:DNN is firstly utilized for training the model with worm payloads and their corresponding signatures as input in the training phrase. After worm payloads are fed into the trained DNN model in the test phrase, worm signatures are generated by our proposed Signature Beam Search algorithm. In the experiment, we firstly analyzed the impact of different data preprocessing methods and the number of convolution-pooling layers in the CNN model on the worm detection performance. Then we analyzed the effects of different signatures in the DNN algorithm on the automatic generation of worm signatures. Experiments show that the generated signatures have a good detection performance.

show abstract

Section: Related Workmentioning

confidence: 99%