Automated Worm Fingerprinting

By Sumeet Singh, Cristian Estan, George Varghese, Stefan Savage. USENIX Symposium on Operating Systems Design and Implementation, 2004

614 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/5c74a7b05e1d73b4a5f914e296d5e44516f0717a

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Paragraph: Thwarting Signature Learning by Training Maliciously (2006, unknown): “Most of these systems, such as Honeycomb [8], EarlyBird [21], and Autograph [7], have been shown not to be able to handle polymorphic worms [15].”
Limits of Learning-based Signature Generation with Adversaries (2008, unknown): “, by extracting byte patterns that uniquely distinguish exploits using network traffic statistics [17, 18, 20, 25, 29].”
Advanced Allergy Attacks: Does a Corpus Really Help? (2007, background): “As a result, the generated signatures will be deemed acceptable when matched against the blacklist in [17,5], or any static corpus which cannot predict what future traffic will be like.”
Dynamic Taint Analysis for Automatic Detection, Analysis, and SignatureGeneration of Exploits on Commodity Software (2005, background): “• Flows that contain byte patterns that are suddenly very common, and are seen going between many source/destination pairs [50], or contain unusual byte patterns that match both incoming and outgoing traffic.”
Automated Classification and Analysis of Internet Malware (2007, background): “[30] automatically generated network-level signatures for malware by finding common byte sequences sent from many sources to many destinations, which is characteristic of worm propagation.”
Vigilante: end-to-end containment of internet worms (2005, background): “Worm signatures have traditionally been generated by humans but there are several recent proposals to generate signatures automatically [24, 22, 38].”
On the infeasibility of modeling polymorphic shellcode (2007, background): “Many signature gen eration schemes focus on relatively simple detection heuristi cs, such as traffic characteristics [35, 22] ( e.”
Polygraph: automatically generating signatures for polymorphic worms (2005, background): “Our evaluation of these algorithms on a range of polymorphic worms demonstrates that Polygraph produces signatures for polymorphic worms that exhibit low false negatives and false positives.”
Hamsa: fast signature generation for zero-day polymorphic worms with provable attack resilience (2006, methodology): “Early automated worm signature generation efforts include Honeycomb [12], Autograph [10], and EarlyBird [24].”
Effective and Efficient Malware Detection at the End Host (2009, background): “At a conceptual level, the idea of monitoring a piece of malware and extracting a model for it bears some resemblance to previous signature generation systems [32, 41].”
A high throughput string matching architecture for intrusion detection and prevention (2005, background): “Non-Interrupting Rule Update: Currently the Snort rule set is updated roughly monthly but researchers are currently working on systems that will provide a real-time response to new attacks and worms [26].”
Allergy Attack Against Automatic Signature Generation (2006, methodology): “Among the proposed ASG systems, many employ simple byte sequence(s) as signatures [4,5,7,8,11,13,14].”
Anomalous Payload-Based Worm Detection and Signature Generation (2005, background): “Earlybird [14] is another system that can automatically detect unknown worms and generate signatures for them.”
Anagram: A Content Anomaly Detector Resistant to Mimicry Attack (2006, background): “However, invariants remain in the packet payloads: the exploit code, the sequence of commands, or the special URL that should not appear in the normal content flow to the target application [19, 20].”
Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces (2010, background): “The vast majority of malware needs a network connection in order to perpetrate their malicious activities (e.g., sending spam, exfiltrating private data, downloading malware updates, etc.).”