An Automated Signature-Based Approach against Polymorphic Internet Worms

[huskates14]

An Automated Signature-Based Approach against Polymorphic Internet Worms
Yong Tang and Shigang Chen
IEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 18, NO. 7
Abstract
Capable of infecting hundreds of thousands of hosts, worms represent a major threat to the Internet. However, the defenseagainst them is still an open problem. This paper attempts to answer an important question: How can we distinguish polymorphicworms from normal background traffic? We propose a new worm signature, called the position-aware distribution signature (PADS),which fills the gap between traditional signatures and anomaly-based intrusion detection systems. The new signature is a collection ofposition-aware byte frequency distributions. It is more flexible than the traditional signatures of fixed strings while it is more precise thanthe position-unaware statistical signatures. We propose two algorithms based on Expectation-Maximization (EM) and Gibbs Samplingto efficiently compute PADS from a set of polymorphic worm samples. We also discuss how to separate a mixture of different
polymorphic worms such that their respective PADS signatures can be calculated. We perform extensive experiments to demonstratethe effectiveness of PADS in separating new worm variants from normal background traffic.