Hamsa: fast signature generation for zero-day polymorphic worms with provable attack resilience

By Zhichun Li, Manan Sanghi, Yan Chen, M. Kao, Brian Chavez. 2006

319 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Battista Biggio
2. Fabio Roli
3. Giorgio Giacinto
4. Giorgio Fumera
5. Blaine Nelson
6. Nicolas Papernot
7. Nicholas Carlini
8. Pavel Laskov

In Computer Networks and Communications

1. Fabio Roli
2. Battista Biggio
3. Blaine Nelson
4. Giorgio Giacinto
5. Pavel Laskov
6. Giorgio Fumera
7. Igino Corona
8. Marius Kloft

In Signal Processing

1. Battista Biggio
2. Fabio Roli
3. Giorgio Giacinto
4. Blaine Nelson
5. Giorgio Fumera
6. Pavel Laskov
7. Davide Maiorca
8. Igino Corona

Citations in the corpus

• Security analysis of online centroid anomaly detection (2010, background): “Another typical application of learning methods is automatic signature generation which drastically reduces the time needed for a production and deployment of attack signatures (Newsome et al., 2006; Li et al., 2006). Machine learning methods can also help researchers to better understand the design”
• Paragraph: Thwarting Signature Learning by Training Maliciously (2006, neutral): “At this time, the only automatic polymorphic worm signature generation systems that are based on learning are Polygraph [15] and Hamsa [9].”
• Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues (2013, background): “recognize them [62], [69], and inject an unbounded percentage of fake, poisoning attack patterns to mislead machine learning algorithms based on malicious traffic collected by honeypots [95], [116], [105], [57].”
• Automated Classification and Analysis of Internet Malware (2007, background): “Related work in malware collection, analysis, and signature generation has primarily explored static and byte-level signatures [23,17] focusing on invariant content.”
• Advanced Allergy Attacks: Does a Corpus Really Help? (2007, methodology): “4.1, 5.1 and 5.3 (which target encoded dates and requests for less popular pages under CNN.com, and the identification cookie used by Google.com respectively) against Polygraph [12] and Hamsa [8].”
• Open problems in the security of learning (2008, methodology): “Hamsa: fast signature generation for zero-day polymorphic worms with provable attack resilience.”
• Limits of Learning-based Signature Generation with Adversaries (2008, methodology): “Below, we motivate the notion of reflecting sets and give formal definitions, focusing on pattern-extraction algorithms, especi ally Polygraph [25] & Hamsa [ 20 ].”
• A Survey on Internet Traffic Identification (2009, methodology): “To ease the manual signature construction process, some approaches focus on extracting application signatures from IP traf fi c payload content automatically [47][48][49].”
• Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces (2010, methodology): “Automatic generation of network signatures has been explored in various previous work [23, 24, 29, 32, 33].”
• Machine learning in adversarial environments (2010, methodology): “Researches have also demonstrated that unique Nash equilibria exist for some types of adversarial situations (Brückner and Scheffer 2009).”