CT-ISG: Router-Based Signature Generation for Zero-Day Polymorphic Worms

严晨西北大学P0627751小组：P060969摘要攻击在当今的网络中司空见惯，快速准确地识别它们对于大型网络/服务运营商来说至关重要。现有的入侵检测系统大多是基于特征的。但这种签名通常是手动或半手动生成的，对于防御自我传播的恶意代码或蠕虫来说，这一过程太慢了。为了逃避签名的检测，攻击者还可以利用多态蠕虫在每次连续感染时改变其字节序列。为了挫败零日蠕虫攻击，必须设计一个针对多态蠕虫的签名自动生成系统，该系统可以部署在网络网关/路由器上，并满足以下要求：基于网络、容忍噪声、攻击弹性和具有高效的签名匹配。现有的工作没有一个满足以上所有要求。NAPOLEON由基于令牌的签名生成器(TOSG)和基于长度的签名生成器(LESG)两部分组成，两者相辅相成，将理论计算机科学与实际网络安全研究相结合。PI在网络异常/入侵检测方面拥有丰富的经验。该联合PI的专业知识是理论计算机科学和算法，并有将其应用于包括安全在内的各种应用的记录。这一跨学科研究将产生强大的影响。例如，在PI的合作中，他们发现生物信息学中的某些算法技术直接或间接适用于蠕虫检测问题。

Yan ChenNorthwestern University0627751Panel: P060969AbstractAttacks are commonplace in today's networks, and identifying themrapidly and accurately is critical for large network/serviceoperators. Most existing intrusion detection systems (IDSes) aresignatures-based. But such signatures are usually generated manuallyor semi-manually, a process too slow for defending againstself-propagating malicious codes, or worms. To evade detection bysignatures, attackers may also employ polymorphic worms which changetheir byte sequence at every successive infection.In order to thwart a zero-day worm attack, it is essential to designan automatic signature generation system against polymorphic wormswhich may be deployed at the network gateways/routers and satisfythe following requirements: network-based, noise-tolerant,attack-resilient, and having efficient signature matching.None of the existing work satisfy all the requirements above. Thusthe PIs design NAPOLEON( Network-based Attack-resilientPOLymophic-worm signaturE generatiON), a network-based automaticsignature generation system with all the aforementioned properties.NAPOLEON has two components which complement each other: TOken-basedSignature Generator (called TOSG) and LEngth-based SignatureGenerator (called LESG).This project combines theoretical computer science with practicalnetwork security research. The PI has extensive experience onnetwork anomaly/intrusion detection. The co-PI's expertise is intheoretical computer science and algorithms and has a track recordof applying them to various applications including security.This interdisciplinary research will have a strong impact. Forexample, during the PIs' collaboration, they have found that certainalgorithmic techniques in bioinformatics are directly or indirectlyapplicable to worm detection problems.