Polymorphic worm detection using double-honeynet
Author(s)
Author(s)
Mohammed, M. M. Z. E.
Ventura, N.
Hashim, M.
Amin, I.
Date Issued
2009
Publisher
IEEE
Related Publication(s)
Proceedings of the 2009 Fourth International Conference on Software Engineering Advances (ICSEA)
Start page
401
End page
406
Abstract
Internet worms are increasing every year, and they increasingly threaten the availability and integrity of Internet-based services. Polymorphic worms evade signature-based Intrusion Detection Systems (IDSs) by varying their payload on every infection attempt. In this paper, we propose a system for automated signature generation for Zero-day polymorphic worms. We have designed a novel double-honeynet system, which is able to detect new worms that have not been seen before. The system is based on an efficient algorithm that uses worms binary representation for pattern matching. The system is able to generate accurate signatures for single and multiple worms.
SFU Affiliated Publication
No
Availability at SFU Library
No database links found.