Differencing Worm Flows and Normal Flows for Automatic Generation of Worm Signatures

Abstract

Internet worms pose a serious threat to networks. Most current Intrusion Detection Systems (IDSs) take signature matching approach to detect worms. Given the fact that most signatures are developed manually, generating new signatures for each variant of a worm incurs significant overhead. In this paper, we propose a difference-based scheme which differences worm flows and normal flows to generate robust worm signatures. The proposed scheme is based on two observational facts -worm flows contain several invariant portions in their payloads, and core worm codes do not exist in normal flows. It uses samples of worm flows detected by available means to extract common tokens. It then differences the set of these tokens with those of normal flows and generates signature candidates. By using such signatures within enterprises, out of reach of worm writers, the possibility of being tricked by worm writers can be reduced. We evaluate the proposed scheme using real network traffic traces that contains worms. Experiment results show that the proposed scheme exhibits high detection rate with low false positives.

Combating against internet worms in large‐scale networks: an autonomic signature‐based solution

“…The main objective here is to sort worms (and worms only) at MSM and generate a highly accurate signature to ensure a high detection rate against the same kind of worms that try to penetrate into the network. Our results, illustrated in Reference [10] and in Section 5.2 demonstrate that the accuracy of these signatures for NetSky and Beagle traces used in our experiments is over 99.5%.…”

“…Polygraph [21] addresses this problem by using multiple substrings as signature. In Reference [10], the authors also generate multiple substring signature by differentiating normal flows from worm flows.…”

“…A MSM uses cluster analysis to sort worms out of the suspicious contents transmitted by its local managers. The MSM then automatically generates signature from the sorted worms by using a differentiation-based approach presented in Reference [10]. It then sends the generated signature to the GSM.…”

NIS08-1: A Multi-level Security Based Autonomic Parameter Selection Approach for an Effective and Early Detection of Internet Worms

“…The sorted worms are used to generate the signature for the propagating worm. The generated signature consists of multiple substrings that commonly exist in worm flows but not in normal flows [11].…”

“…The authors propose a signature-based hierarchical worm detection technique for large scale networks in [10] and a multiple-substrings signature generation approach in [11]. These systems deploy several parameters in order to enforce suitable security policies.…”