An architecture for generating semantics-aware signatures

Authors:
Vinod Yegneswaran;Jonathon T. Giffin;Paul Barford;Somesh Jha
Affiliations:
Computer Sciences Department, University of Wisconsin, Madison;Computer Sciences Department, University of Wisconsin, Madison;Computer Sciences Department, University of Wisconsin, Madison;Computer Sciences Department, University of Wisconsin, Madison
Venue:
SSYM'05 Proceedings of the 14th conference on USENIX Security Symposium - Volume 14
Year:
2005

Citing 16
Cited 38

Mining association rules between sets of items in large databases

SIGMOD '93 Proceedings of the 1993 ACM SIGMOD international conference on Management of data
A practical clustering algorithm for static and dynamic information organization

Proceedings of the tenth annual ACM-SIAM symposium on Discrete algorithms
NetSTAT: a network-based intrusion detection system

Journal of Computer Security
Practical automated detection of stealthy portscans

Journal of Computer Security
How to Own the Internet in Your Spare Time

Proceedings of the 11th USENIX Security Symposium
Active Mapping: Resisting NIDS Evasion without Altering Traffic

SP '03 Proceedings of the 2003 IEEE Symposium on Security and Privacy
Enhancing byte-level network intrusion detection signatures with context

Proceedings of the 10th ACM conference on Computer and communications security
Clustering intrusion detection alarms to support root cause analysis

ACM Transactions on Information and System Security (TISSEC)
Characteristics of internet background radiation

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
Testing network-based intrusion detection signatures using mutant exploits

Proceedings of the 11th ACM conference on Computer and communications security
Semantics-Aware Malware Detection

SP '05 Proceedings of the 2005 IEEE Symposium on Security and Privacy
Automated worm fingerprinting

OSDI'04 Proceedings of the 6th conference on Symposium on Opearting Systems Design & Implementation - Volume 6
Network intrusion detection: evasion, traffic normalization, and end-to-end protocol semantics

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
A virtual honeypot framework

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
Autograph: toward automated, distributed worm signature detection

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
Bro: a system for detecting network intruders in real-time

SSYM'98 Proceedings of the 7th conference on USENIX Security Symposium - Volume 7

Fast and automated generation of attack signatures: a basis for building self-protecting servers

Proceedings of the 12th ACM conference on Computer and communications security
On deriving unknown vulnerabilities from zero-day polymorphic and metamorphic worm exploits

Proceedings of the 12th ACM conference on Computer and communications security
Privacy-preserving payload-based correlation for accurate malicious traffic detection

Proceedings of the 2006 SIGCOMM workshop on Large-scale attack defense
Protomatching network traffic for high throughputnetwork intrusion detection

Proceedings of the 13th ACM conference on Computer and communications security
Analyzing network traffic to detect self-decrypting exploit code

ASIACCS '07 Proceedings of the 2nd ACM symposium on Information, computer and communications security
On the infeasibility of modeling polymorphic shellcode

Proceedings of the 14th ACM conference on Computer and communications security
Evaluation of collaborative worm containment on the DETER testbed

DETER Proceedings of the DETER Community Workshop on Cyber Security Experimentation and Test on DETER Community Workshop on Cyber Security Experimentation and Test 2007
Syntax vs. semantics: competing approaches to dynamic network intrusion detection

International Journal of Security and Networks
Polymorphic worm detection using token-pair signatures

Proceedings of the 4th international workshop on Security, privacy and trust in pervasive and ubiquitous computing
Context-aware clustering of DNS query traffic

Proceedings of the 8th ACM SIGCOMM conference on Internet measurement
Vigilante: End-to-end containment of Internet worm epidemics

ACM Transactions on Computer Systems (TOCS)
Fast and Black-box Exploit Detection and Signature Generation for Commodity Software

ACM Transactions on Information and System Security (TISSEC)
A data mining approach for analysis of worm activity through automatic signature generation

Proceedings of the 1st ACM workshop on Workshop on AISec
Fast Signature Matching Using Extended Finite Automaton (XFA)

ICISS '08 Proceedings of the 4th International Conference on Information Systems Security
To catch a predator: a natural language approach for eliciting malicious payloads

SS'08 Proceedings of the 17th conference on Security symposium
Filtering False Positives Based on Server-Side Behaviors

IEICE - Transactions on Information and Systems
Spatio-temporal network anomaly detection by assessing deviations of empirical measures

IEEE/ACM Transactions on Networking (TON)
Automatic Generation of String Signatures for Malware Detection

RAID '09 Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection
Towards Generating High Coverage Vulnerability-Based Signatures with Protocol-Level Constraint-Guided Exploration

RAID '09 Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection
Botzilla: detecting the "phoning home" of malicious software

Proceedings of the 2010 ACM Symposium on Applied Computing
Automated classification and analysis of internet malware

RAID'07 Proceedings of the 10th international conference on Recent advances in intrusion detection
Thwarting zero-day polymorphic worms with network-level length-based signature generation

IEEE/ACM Transactions on Networking (TON)
Behavioral clustering of HTTP-based malware and signature generation using malicious network traces

NSDI'10 Proceedings of the 7th USENIX conference on Networked systems design and implementation
Mimimorphism: a new approach to binary code obfuscation

Proceedings of the 17th ACM conference on Computer and communications security
Network intrusion detection with semantics-aware capability

IPDPS'06 Proceedings of the 20th international conference on Parallel and distributed processing
Searching the searchers with searchaudit

USENIX Security'10 Proceedings of the 19th USENIX conference on Security
Automatic generation of remediation procedures for malware infections

USENIX Security'10 Proceedings of the 19th USENIX conference on Security
ARROW: GenerAting SignatuRes to Detect DRive-By DOWnloads

Proceedings of the 20th international conference on World wide web
Heat-seeking honeypots: design and experience

Proceedings of the 20th international conference on World wide web
Fast, memory-efficient regular expression matching with NFA-OBDDs

Computer Networks: The International Journal of Computer and Telecommunications Networking
Integrating innate and adaptive immunity for intrusion detection

ICARIS'06 Proceedings of the 5th international conference on Artificial Immune Systems
Graph based signature classes for detecting polymorphic worms via content analysis

Computer Networks: The International Journal of Computer and Telecommunications Networking
Allergy attack against automatic signature generation

RAID'06 Proceedings of the 9th international conference on Recent Advances in Intrusion Detection
Fast and evasive attacks: highlighting the challenges ahead

RAID'06 Proceedings of the 9th international conference on Recent Advances in Intrusion Detection
Generating simplified regular expression signatures for polymorphic worms

ATC'07 Proceedings of the 4th international conference on Autonomic and Trusted Computing
An anomaly-based detection in ubiquitous network using the equilibrium state of the catastrophe theory

The Journal of Supercomputing
Detection and classification of peer-to-peer traffic: A survey

ACM Computing Surveys (CSUR)
Subverting system authentication with context-aware, reactive virtual machine introspection

Proceedings of the 29th Annual Computer Security Applications Conference

Quantified Score

Hi-index	0.00

Visualization

Abstract

Identifying new intrusions and developing effective signatures that detect them is essential for protecting computer networks. We present Nemean, a system for automatic generation of intrusion signatures from honeynet packet traces. Our architecture is distinguished by its emphasis on a modular design framework that encourages independent development and modification of system components and protocol semantics awareness which allows for construction of signatures that greatly reduce false alarms. The building blocks of our architecture include transport and service normalization, intrusion profile clustering and automata learning that generates connection and session aware signatures. We demonstrate the potential of Nemean's semantics-aware, resilient signatures through a prototype implementation. We use two datasets to evaluate the system: (i) a production dataset for false-alarm evaluation and (ii) a honeynet dataset for measuring detection rates. Signatures generated by Nemean for NetBIOS exploits had a 0% false-positive rate and a 0.04% false-negative rate.