A Novel Signature Generation Approach for Polymorphic Worms

摘要

Because of complex polymorphism in worms and the disturbance of crafted noises, it becomes more difficult to generate signatures quickly and accurately. This paper proposes a neighbor relation signature (NRS) for polymorphic worms,which is a collection of distance frequency distributions between neighbor byte. Moreover, we propose a signature generation algorithm (NRS-CC) by combing NRS and color coding technique. NRS-CC selects sequences randomly from suspicious flow pool to generate neighbor relation signatures, and then uses color coding technique to get rid of noise disturbance. Extensive experiments axe carried out to demonstrate the validity of our approach. The experiment results show that our approach can generate polymorphic signature more quickly compared with existing signature generate approaches when the suspicious flow pool contains noise sequences.