ERES: an extended regular expression signature for polymorphic worm detection
| Autor: | Razieh Eskandari, Mojtaba Mostafavi Ghahfarokhi, Mahdi Shajari |
|---|---|
| Rok vydání: | 2019 |
| Předmět: |
021110 strategic
defence & security studies business.industry Computer science 0211 other engineering and technologies Process (computing) 02 engineering and technology Security token Signature (logic) Set (abstract data type) Computational Theory and Mathematics Hardware and Architecture 020204 information systems Face (geometry) Noise tolerance 0202 electrical engineering electronic engineering information engineering Computer Science (miscellaneous) The Internet Regular expression business Algorithm Software Computer Science::Cryptography and Security |
| Zdroj: | Journal of Computer Virology and Hacking Techniques. 15:177-194 |
| ISSN: | 2263-8733 |
| DOI: | 10.1007/s11416-019-00330-1 |
| Popis: | The quick spreading of modern sophisticated polymorphic worms poses a serious threat to the internet security. So far, several signature classes have been proposed to face this challenge. Although taking patterns such as 1-byte invariants and distance restrictions into signature classes are considered in the previous schemes, they do not consider the set of specific values, which are important in the successful execution of a worm. In this paper, we introduce a new signature type, called ERES (Extended Regular Expression Signature). By considering all the above specifications, along with the probability of being a worm, in the worm signature, ERES generates a more specific signature leading to a more accurate detection. In addition, to accelerate the signature extraction process, it combines token extraction with sequence alignment. Evaluations based on multiple polymorphic worms demonstrate that this approach is more acceptable in terms of speed, accuracy, and noise tolerance. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|
Full text from SpringerLink