Abstract

It is widely believed that content-signature-based intrusion detection systems (IDSes) are easily evaded by polymorphic worms, which vary their payload on every infection attempt. In this paper, we present Polygraph, a signature generation system that successfully produces signatures that match polymorphic worms. Polygraph generates signatures that consist of multiple disjoint content substrings. In doing so, Polygraph leverages our insight that for a real-world exploit to function properly, multiple invariant substrings must often be present in all variants of a payload; these substrings typically correspond to protocol framing, return addresses, and in some cases, poorly obfuscated code. We contribute a definition of the polymorphic signature generation problem; propose classes of signature suited for matching polymorphic worm payloads; and present algorithms for automatic generation of signatures in these classes. Our evaluation of these algorithms on a range of polymorphic worms demonstrates that Polygraph produces signatures for polymorphic worms that exhibit low false negatives and false positives. 1.

Citations

1094	Identification of common molecular subsequences - Smith, Waterman - 1981
773	Algorithms on Strings, Trees and Sequences - Gusfield - 1997
564	Bro: A system for detecting network intruders in real-time. Computer Networks - Paxson - 1999
380	Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software - Newsome, Song - 2005
372	Detecting subtle sequence signals: a Gibbs sampling strategy for multiple alignment - Lawrence - 1993
327	Fitting a Mixture Model by Expectation Maximization to Discover Motifs in Biopolymers - Bailey, Elkan - 1994
261	B.: Autograph: Toward automated, distributed worm signature detection - Kim, Karp
239	Automated worm fingerprinting - Singh, Estan, et al. - 2004
146	Shield: Vulnerability-driven network filters for preventing known vulnerability exploits - Wang, Guo, et al. - 2004
142	Honeycomb - creating intrusion detection signatures using honeypots - Kreibich, Crowcroft - 2003
68	Hunting for Metamorphic - Ször, Ferrie - 2001
56	The Open Source Network Intrusion Detection System. http://www.snort.org - Snort
52	Polymorphic shellcode engine using spectrum analysis - Detristan, Ulenspiegel, et al. - 2003
51	Testing Network-based Intrusion Detection Signatures using Mutant Exploits - Vigna, Robertson, et al. - 2004
47	Color set size problem with applications to string matching - Hui - 1992
25	Buttercup: On Network-based Detection of Polymorphic Buffer Overflow Vulnerabilities - Pasupulati, Coit, et al.
25	Logos: A modular Bayesian model for de novo motif detection - EP, Wu, et al. - 2004
7	Apache apr-psprintf memory corruption vulnerability. http://web. nvd.nist.gov - CAN-2003-0245
2	Computer virus-antivirus coevolution - Nachanberg - 1997
1	Motifprototyper: a profile bayesian model for motif family - Xing, Karp