Automatic attack signature generation systems: A review

Abstract

Signature-based intrusion detection systems provide solutions to counter the increasing number of attacks on network resources. But this is not helpful for novel attacks whose signatures aren't available. Automated signature generation systems can work proactively to detect these attacks in real time and generate signatures of new attacks. This article analyzes the latest developments, including Honeycyber, Hancock, Arbor, Auto-Sign, Argos, Hamsa, F-Sign, and a hybrid honeyfarm-based defense system, comparing these systems on the basis of their ability to detect novel attacks, signature generation method, suitability for multiple instances of worms, type of signature generated, attacks and worms covered, false alarm rates, and relative strengths and weaknesses.