CT-ISG: Router-Based Signature Generation for Zero-Day Polymorphic Worms

点击翻译按钮获取中文摘要

Yan ChenNorthwestern University0627751Panel: P060969AbstractAttacks are commonplace in today's networks, and identifying themrapidly and accurately is critical for large network/serviceoperators. Most existing intrusion detection systems (IDSes) aresignatures-based. But such signatures are usually generated manuallyor semi-manually, a process too slow for defending againstself-propagating malicious codes, or worms. To evade detection bysignatures, attackers may also employ polymorphic worms which changetheir byte sequence at every successive infection.In order to thwart a zero-day worm attack, it is essential to designan automatic signature generation system against polymorphic wormswhich may be deployed at the network gateways/routers and satisfythe following requirements: network-based, noise-tolerant,attack-resilient, and having efficient signature matching.None of the existing work satisfy all the requirements above. Thusthe PIs design NAPOLEON( Network-based Attack-resilientPOLymophic-worm signaturE generatiON), a network-based automaticsignature generation system with all the aforementioned properties.NAPOLEON has two components which complement each other: TOken-basedSignature Generator (called TOSG) and LEngth-based SignatureGenerator (called LESG).This project combines theoretical computer science with practicalnetwork security research. The PI has extensive experience onnetwork anomaly/intrusion detection. The co-PI's expertise is intheoretical computer science and algorithms and has a track recordof applying them to various applications including security.This interdisciplinary research will have a strong impact. Forexample, during the PIs' collaboration, they have found that certainalgorithmic techniques in bioinformatics are directly or indirectlyapplicable to worm detection problems.