An automated signature generation method for zero-day polymorphic worms based on Multilayer Perceptron Model
Author(s)
Author(s)
Mohammed, M. M. Z. E.
Ventura, N.
Pathan, A.-S. K.
Date Issued
2013
Publisher
IEEE
Related Publication(s)
Proceedings of the 2013 International Conference on Advanced Computer Science Applications and Technologies (ACSAT)
Start page
450
End page
455
Abstract
Polymorphic worms are considered as the most dangerous threats to the Internet security, and the danger lies in changing their payloads in every infection attempt to avoid the security systems. In this paper, we propose an accurate signature generation system for zero-day polymorphic worms. We have designed a novel Double-honeynet system, which is able to detect zero-day polymorphic worms that have not been seen before. To generate signatures for polymorphic worms we have two steps. The first step is the polymorphic worms sample collection which is done by the Double-honeynet system. The second step is the signature generation for the collected samples which is done by k-means clustering algorithm and a Multilayer Perceptron Model. The system collects different types of polymorphic worms, we used the k-means clustering algorithm to separate each type into a cluster. The Multilayer Perceptron Model is used to generate signatures for each cluster. The main goal for this system is to reduce the false positives and false negatives.
SFU Affiliated Publication
No
Availability at SFU Library
No database links found.