首页>
外文OA文献
>Using a bioinformatics approach to generate accurate exploit-based signatures for polymorphic worms
【2h】
Using a bioinformatics approach to generate accurate exploit-based signatures for polymorphic worms
展开▼
机译:使用生物信息学方法为多态蠕虫生成基于攻击的准确签名
展开▼
免费
页面导航
摘要
著录项
引文网络
相似文献
相关主题
摘要
In this paper, we propose Simplified Regular Expression (SRE) signature, which uses multiple sequence alignment techniques, drawn from bioinformatics, in a novel approach to generating more accurate exploit-based signatures. We also provide formal definitions of what is "a more specific" and what is "the most specific" signature for a polymorphic worm and show that the most specific exploit-based signature generation is NP-hard. The approach involves three steps: multiple sequence alignment to reward consecutive substring extractions, noise elimination to remove noise effects, and signature transformation to make the SRE signature compatible with current IDSs. Experiments on a range of polymorphic worms and real-world polymorphic shellcodes show that our bioinformatics approach is noise-tolerant and as that because it extracts more polymorphic worm characters, like one-byte invariants and distance restrictions between invariant bytes, the signatures it generates are more accurate and precise than those generated by some other exploit-based signature generation schemes.
展开▼