A modified Knuth-Morris-Pratt Algorithm for zero-day polymorphic worms detection

Author(s)
Author(s)
Mohammed, M. M. Z. E.
Ventura, N.
Hashim, M.
Amin, I.
Date Issued
2009
Publisher
CSREA Press
Related Publication(s)
Proceedings of the 2009 International Conference on Security and Management (SAM)
Abstract
Internet worms pose a major threat to institutions, companies, organizations, universities, and the like, and their destruction causes loss of millions of dollars. Therefore, the networks must be protected as much as possible to avoid losses. In this paper we propose automatic and accurate system for signature generation for unknown polymorphic worms. We have designed a novel double-honeynet system, which is able to detect new worms that have not been seen before. The system is based on a modified Knuth-Morris-Pratt Algorithm that uses polymorphic worm substrings to find multiple invariant substrings that are shared between all polymorphic worm instances and use them as signatures. The system is able to generate accurate signatures for single and multiple worms.
URI
SFU Affiliated Publication
No
Availability at SFU Library

No database links found.