Hamsa: Fast Signature Generation for Zero-day PolymorphicWorms with Provable Attack Resilience

Authors:
Zhichun Li;Manan Sanghi;Yan Chen;Ming-Yang Kao;Brian Chavez
Affiliations:
Northwestern University, Evanston, IL;Northwestern University, Evanston, IL;Northwestern University, Evanston, IL;Northwestern University, Evanston, IL;Northwestern University, Evanston, IL
Venue:
SP '06 Proceedings of the 2006 IEEE Symposium on Security and Privacy
Year:
2006

Citing 0
Cited 58

WormTerminator: an effective containment of unknown and polymorphic fast spreading worms

Proceedings of the 2006 ACM/IEEE symposium on Architecture for networking and communications systems
Analyzing network traffic to detect self-decrypting exploit code

ASIACCS '07 Proceedings of the 2nd ACM symposium on Information, computer and communications security
WormShield: Fast Worm Signature Generation with Distributed Fingerprint Aggregation

IEEE Transactions on Dependable and Secure Computing
AutoPaG: towards automated software patch generation with source code root cause identification and repair

ASIACCS '07 Proceedings of the 2nd ACM symposium on Information, computer and communications security
Evaluation of collaborative worm containment on the DETER testbed

DETER Proceedings of the DETER Community Workshop on Cyber Security Experimentation and Test on DETER Community Workshop on Cyber Security Experimentation and Test 2007
Catch me, if you can: evading network signatures with web-based polymorphic worms

WOOT '07 Proceedings of the first USENIX workshop on Offensive Technologies
Design and analysis of a multipacket signature detection system

International Journal of Security and Networks
LISABETH: automated content-based signature generator for zero-day polymorphic worms

Proceedings of the fourth international workshop on Software engineering for secure systems
Polymorphic worm detection using token-pair signatures

Proceedings of the 4th international workshop on Security, privacy and trust in pervasive and ubiquitous computing
Spamming botnets: signatures and characteristics

Proceedings of the ACM SIGCOMM 2008 conference on Data communication
Open problems in the security of learning

Proceedings of the 1st ACM workshop on Workshop on AISec
A rough set approach for automatic key attributes identification of zero-day polymorphic worms

Expert Systems with Applications: An International Journal
Malyzer: Defeating Anti-detection for Application-Level Malware Analysis

ACNS '09 Proceedings of the 7th International Conference on Applied Cryptography and Network Security
On the impacts of human interactions in MMORPG traffic

Multimedia Tools and Applications
Robust signatures for kernel data structures

Proceedings of the 16th ACM conference on Computer and communications security
Automatic Generation of String Signatures for Malware Detection

RAID '09 Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection
Towards Generating High Coverage Vulnerability-Based Signatures with Protocol-Level Constraint-Guided Exploration

RAID '09 Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection
DROP: Detecting Return-Oriented Programming Malicious Code

ICISS '09 Proceedings of the 5th International Conference on Information Systems Security
Botzilla: detecting the "phoning home" of malicious software

Proceedings of the 2010 ACM Symposium on Applied Computing
Emulation-based detection of non-self-contained polymorphic shellcode

RAID'07 Proceedings of the 10th international conference on Recent advances in intrusion detection
Automated classification and analysis of internet malware

RAID'07 Proceedings of the 10th international conference on Recent advances in intrusion detection
Advanced allergy attacks: does a corpus really help

RAID'07 Proceedings of the 10th international conference on Recent advances in intrusion detection
Probabilistic identification for hard to classify protocol

WISTP'08 Proceedings of the 2nd IFIP WG 11.2 international conference on Information security theory and practices: smart devices, convergence and next generation networks
Automatically generating models for botnet detection

ESORICS'09 Proceedings of the 14th European conference on Research in computer security
Client-side detection of XSS worms by monitoring payload propagation

ESORICS'09 Proceedings of the 14th European conference on Research in computer security
Thwarting zero-day polymorphic worms with network-level length-based signature generation

IEEE/ACM Transactions on Networking (TON)
Lightweight static analysis to detect polymorphic exploit code with static analysis resistant technique

ICC'09 Proceedings of the 2009 IEEE international conference on Communications
An automated signature generation approach for polymorphic worm based on color coding

ICC'09 Proceedings of the 2009 IEEE international conference on Communications
Behavioral clustering of HTTP-based malware and signature generation using malicious network traces

NSDI'10 Proceedings of the 7th USENIX conference on Networked systems design and implementation
Machine learning in adversarial environments

Machine Learning
Mimimorphism: a new approach to binary code obfuscation

Proceedings of the 17th ACM conference on Computer and communications security
Searching the searchers with searchaudit

USENIX Security'10 Proceedings of the 19th USENIX conference on Security
Automatic generation of remediation procedures for malware infections

USENIX Security'10 Proceedings of the 19th USENIX conference on Security
Inside the permutation-scanning worms: propagation modeling and analysis

IEEE/ACM Transactions on Networking (TON)
ARROW: GenerAting SignatuRes to Detect DRive-By DOWnloads

Proceedings of the 20th international conference on World wide web
Cloud-based malware detection for evolving data streams

ACM Transactions on Management Information Systems (TMIS)
JACKSTRAWS: picking command and control connections from bot traffic

SEC'11 Proceedings of the 20th USENIX conference on Security
Graph based signature classes for detecting polymorphic worms via content analysis

Computer Networks: The International Journal of Computer and Telecommunications Networking
Generating regular expression signatures for network traffic classification in trusted network management

Journal of Network and Computer Applications
Paragraph: thwarting signature learning by training maliciously

RAID'06 Proceedings of the 9th international conference on Recent Advances in Intrusion Detection
Re-wiring activity of malicious networks

PAM'12 Proceedings of the 13th international conference on Passive and Active Measurement
Adversarial support vector machine learning

Proceedings of the 18th ACM SIGKDD international conference on Knowledge discovery and data mining
AutoDunt: dynamic latent dependence analysis for detection of zero day vulnerability

ICISC'11 Proceedings of the 14th international conference on Information Security and Cryptology
Frankenstein: stitching malware from benign binaries

WOOT'12 Proceedings of the 6th USENIX conference on Offensive Technologies
Blacksheep: detecting compromised hosts in homogeneous crowds

Proceedings of the 2012 ACM conference on Computer and communications security
Polymorphic worms detection using Extended PolyTree

Proceedings of the Second International Conference on Computational Science, Engineering and Information Technology
Generating simplified regular expression signatures for polymorphic worms

ATC'07 Proceedings of the 4th international conference on Autonomic and Trusted Computing
A practical approach for detecting executable codes in network traffic

APNOMS'07 Proceedings of the 10th Asia-Pacific conference on Network Operations and Management Symposium: managing next generation networks and services
DiffSig: resource differentiation based malware behavioral concise signature generation

ICT-EurAsia'13 Proceedings of the 2013 international conference on Information and Communication Technology
Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues

Information Sciences: an International Journal
State of the art: Dynamic symbolic execution for automated test generation

Future Generation Computer Systems
Security analysis of online centroid anomaly detection

The Journal of Machine Learning Research
Detecting machine-morphed malware variants via engine attribution

Journal in Computer Virology
MetaSymploit: day-one defense against script-based attacks with security-enhanced symbolic analysis

SEC'13 Proceedings of the 22nd USENIX conference on Security
Automated signature extraction for high volume attacks

ANCS '13 Proceedings of the ninth ACM/IEEE symposium on Architectures for networking and communications systems
A Host-Based Approach for Unknown Fast-Spreading Worm Detection and Containment

ACM Transactions on Autonomous and Adaptive Systems (TAAS) - Special Section on Best Papers from SEAMS 2012
Design and Implementation of a Data Mining System for Malware Detection

Journal of Integrated Design & Process Science
Generating Lightweight Behavioral Signature for Malware Detection in People-Centric Sensing

Wireless Personal Communications: An International Journal

Quantified Score

Hi-index	0.00

Visualization

Abstract

Zero-day polymorphic worms pose a serious threat to the security of Internet infrastructures. Given their rapid propagation, it is crucial to detect them at edge networks and automatically generate signatures in the early stages of infection. Most existing approaches for automatic signature generation need host information and are thus not applicable for deployment on high-speed network links. In this paper, we propose Hamsa, a network-based automated signature generation system for polymorphic worms which is fast, noise-tolerant and attack-resilient. Essentially, we propose a realistic model to analyze the invariant content of polymorphic worms which allows us to make analytical attack-resilience guarantees for the signature generation algorithm. Evaluation based on a range of polymorphic worms and polymorphic engines demonstrates that Hamsa significantly outperforms Polygraph [16] in terms of efficiency, accuracy, and attack resilience.