DMCA
Thwarting Zero-Day Polymorphic Worms With Network-Level Length-Based Signature Generation
Cached
Download Links
| Citations: | 3 - 1 self |
BibTeX
@MISC{Wang_thwartingzero-day,
author = {Lanjia Wang and Zhichun Li and Yan Chen and Zhi (judy Fu and Xing Li},
title = {Thwarting Zero-Day Polymorphic Worms With Network-Level Length-Based Signature Generation},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Abstract—It is crucial to detect zero-day polymorphic worms and to generate signatures at network gateways or honeynets so that we can prevent worms from propagating at their early phase. However, most existing network-based signatures are specific to exploit and can be easily evaded. In this paper, we propose generating vulnerability-driven signatures at network level without any host-level analysis of worm execution or vulnerable programs. As the first step, we design a network-based length-based signature generator (LESG) for the worms exploiting buffer overflow vulnerabilities1. The signatures generated are intrinsic to buffer overflows, and are very difficult for attackers to evade. We further prove the attack resilience bounds even under worst-case attacks with deliberate noise injection. Moreover, LESG is fast and noisetolerant and has efficient signature matching. Evaluation based on real-world vulnerabilities of various protocols and real network traffic demonstrates that LESG is promising in achieving these goals. Index Terms—length-based signature, polymorphic worm, worm signature generation, zero-day vulnerability. I.
Keyphrases
zero-day polymorphic worm network-level length-based signature generation zero-day vulnerability vulnerability-driven signature early phase network level buffer overflow vulnerabilities1 real-world vulnerability worst-case attack various protocol host-level analysis polymorphic worm first step efficient signature network gateway index term length-based signature deliberate noise injection network-based length-based signature generator real network traffic network-based signature attack resilience worm execution vulnerable program worm signature generation
