Sciweavers

Share
IJSN
2008

Syntax vs. semantics: competing approaches to dynamic network intrusion detection

10 years 2 months ago
Syntax vs. semantics: competing approaches to dynamic network intrusion detection
: Malicious network traffic, including widespread worm activity, is a growing threat to Internet-connected networks and hosts. In this paper, we consider two competing approaches to dynamic network intrusion detection: syntax based and semantics based approaches. For the syntax driven approach, we propose two sliding window based schemes to generate potential worm signatures automatically. Since syntax based approaches cannot cope well with sophisticated polymorphic and metamorphic worms, the semantics-based approach is a better alternative. Our contribution in this work is threefold: (a) our syntax-based scheme that uses variable-length partition with multiple breakmarks can detect many polymorphic worms, (b) we believe our semantic-based prototype is the first NIDS that provides semantics-aware capability and our system is more efficient than what is reported by Christodorescu et al (2005), (c) our designed templates can capture polymorphic shellcodes with added sequences of stack an...
Walter J. Scheirer, Mooi Choo Chuah
Added 12 Dec 2010
Updated 12 Dec 2010
Type Journal
Year 2008
Where IJSN
Authors Walter J. Scheirer, Mooi Choo Chuah
Comments (0)
books