Accurate signature generation for polymorphic worms using principal component analysis

Author(s)
Author(s)
Mohammed. M. M. Z. E.
Ventura, N.
Hashim, M.
Amin, I.
Bashier, E.
Date Issued
2010
Publisher
IEEE
Related Publication(s)
Proceedings of the 2010 IEEE GLOBECOM Workshops (GC Wkshps)
Start page
1555
End page
1560
Abstract
Internet worms pose a major threat to Internet infrastructure security, and their destruction causes loss of millions of dollars. Therefore, the networks must be pro-tected as much as possible to avoid losses. In this paper we propose accurate system for signature generation for Zero-day polymorphic worms. We have designed a novel double-honeynet system, which is able to detect new worms that have not been seen before. We apply Princi-pal Component Analysis (PCA) to determine the most significant substrings that are shared between po-lymorphic worm instances. The experimental results show that the PCA has successfully detected polymorphic worms with zero false positives and zero false negatives.
URI
DOI
SFU Affiliated Publication
No
Availability at SFU Library

No database links found.