Polygraph: automatically generating signatures for polymorphic worms

By James Newsome, Brad Karp, Dawn Song. 2005

751 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Privacy & Security, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Privacy & Security

In Signal Processing

Citations in the corpus

Stealing Hyperparameters in Machine Learning (2018, background): “Existing studies have demonstrated poisoning attacks to worm signature generators [34], [41], [35], spam ﬁlters [31], [32], anomaly detectors [43], [24], SVMs [5], face recognition methods [4], as well as recommender systems [27], [57].”
Paragraph: Thwarting Signature Learning by Training Maliciously (2006, neutral): “At this time, the only automatic polymorphic worm signature generation systems that are based on learning are Polygraph [15] and Hamsa [9].”
Towards Making Systems Forget with Machine Unlearning (2015, neutral): “I. INTRODUCTION”
Polymorphic Worm Detection Using Structural Information of Executables (2005, background): “To detect this threat, novel techniques are needed that are able to identify different variations of the same polymorphic worm [15].”
Hamsa: fast signature generation for zero-day polymorphic worms with provable attack resilience (2006, background): “For our experiments, we found δ = 10−6, a = 20 and b = 0.01 yields good results.”
Allergy Attack Against Automatic Signature Generation (2006, methodology): “Among the proposed ASG systems, many employ simple byte sequence(s) as signatures [4,5,7,8,11,13,14].”
Anagram: A Content Anomaly Detector Resistant to Mimicry Attack (2006, background): “However, invariants remain in the packet payloads: the exploit code, the sequence of commands, or the special URL that should not appear in the normal content flow to the target application [19, 20].”
Automated Classification and Analysis of Internet Malware (2007, background): “Related work in malware collection, analysis, and signature generation has primarily explored static and byte-level signatures [23,17] focusing on invariant content.”
Efficient Repair of Polluted Machine Learning Systems via Causal Unlearning (2018, background): “[35] show that well-crafted fake network flows as part of the training data can significantly influence the worm signatures generated by PolyGraph [34], a worm detection engine.”
Behavior of Machine Learning Algorithms in Adversarial Environments (2010, background): “Red herring attack: Newsome et al. [2006] present Causative Integrity and Causative Availability attacks against Polygraph [Newsome et al.”
Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues (2013, background): “Given a statistically representative set of patterns (training examples) associated to intrusion and/or legitimate activities, machine learning algorithms can automatically build (learn) accurate detection models [92], [104], [25], [84], [144].”
Machine learning in adversarial environments (2010, methodology): “Researches have also demonstrated that unique Nash equilibria exist for some types of adversarial situations (Brückner and Scheffer 2009).”
Machine Learning in the Presence of an Adversary: Attacking and Defending the SpamBayes Spam Filter (2008, background): “Often, security sensitive tasks, such as network intrusion/extrusion detection, financial fraud detection, virus and worm detection, and spam filtering use statistical machine learning algorithms to improve data classification [5, 12, 13, 17, 18, 23].”