Earticle

초록

영어

With growing sophistication of computer worms, it is very important to detect and prevent the worms quickly and accurately at their early phase of infection. Traditional signature based IDS, though effective for known attacks but failed to handle the zero-day attack promptly. Recent works on polymorphic worms does not guarantee accurate signature in presence of noise in suspicious flow samples. In this paper we propose PolyS, an improved version of Hamsa, a network based automated signature generation scheme to thwart zero-day polymorphic worms. We contribute a novel architecture that reduces the noise in suspicious traffic pool, thus enhancing the accuracy of worm’s signature. Also we propose a signature generation algorithm for successfully matching polymorphic worm payload with higher speed and memory efficiency. Analysis shows that our system is fast, accurate, attack-resilient and capable of generating quality signature with low false positive and false negative.

목차

Abstract
 1. Introduction
 2. Related Work
 3. Structure of Polymorphic worms
 4. System Model
  4.1. Architecture
  4.2. Data Control
  4.3 Data Capture
 5. Problem definition
 6. Signature Generation
 7. Conclusion
 Acknowledgements
 References

키워드

저자

• Sounak Paul [ Dept. of Information Technology, Birla Institute of Technology ]
• Bimal Kumar Mishra [ Dept. of Applied Mathematics, Birla Institute of Technology ]

참고문헌

발행기관

간행물

표지보기 관심저널 등록

• 간행물명

  International Journal of Grid and Distributed Computing

• 간기

  격월간

• pISSN

  2005-4262

• 수록기간

  2008~2016

• 십진분류

  KDC 505 DDC 605