Online Detect Polymorphic Exploit Based on Data Mining

摘要

In recent years, Internet worms increasingly threaten the Internet hosts and service and polymorphic worms can evade signature-based intrusion detection systems.We propose DMPolD (Data Ming Polymorphism Detection) to detect polymorphic exploit based on semantic signature and data-mining. We analyze the feature of polymorphic exploit and the feature of perfect ones. We propose a method to online detect worm through recognize JUMP address based on data-mining i.e., Bayes. To prove this idea, we implement a plug-in of Snort ODMSnort and do the experiment on it. The evaluation results show that DMPolD can detect polymorphic exploit and has very low false-positive.