Sciweavers

Share
SP
2005
IEEE

Polygraph: Automatically Generating Signatures for Polymorphic Worms

10 years 7 months ago
Polygraph: Automatically Generating Signatures for Polymorphic Worms
It is widely believed that content-signature-based intrusion detection systems (IDSes) are easily evaded by polymorphic worms, which vary their payload on every infection attempt. In this paper, we present Polygraph, a signature generation system that successfully produces signatures that match polymorphic worms. Polygraph generates signatures that consist of multiple disjoint content substrings. In doing so, Polygraph leverages our insight that for a real-world exploit to function properly, multiple invariant substrings must often be present in all variants of a payload; these substrings typically correspond to protocol framing, return addresses, and in some cases, poorly obfuscated code. We contribute a definition of the polymorphic signature generation problem; propose classes of signature suited for matching polymorphic worm payloads; and present algorithms for automatic generation of signatures in these classes. Our evaluation of these algorithms on a range of polymorphic worms ...
James Newsome, Brad Karp, Dawn Xiaodong Song
Added 25 Jun 2010
Updated 25 Jun 2010
Type Conference
Year 2005
Where SP
Authors James Newsome, Brad Karp, Dawn Xiaodong Song
Comments (0)
books