ERES: an extended regular expression signature for polymorphic worm detection

Abstract

The quick spreading of modern sophisticated polymorphic worms poses a serious threat to the internet security. So far, several signature classes have been proposed to face this challenge. Although taking patterns such as 1-byte invariants and distance restrictions into signature classes are considered in the previous schemes, they do not consider the set of specific values, which are important in the successful execution of a worm. In this paper, we introduce a new signature type, called ERES (Extended Regular Expression Signature). By considering all the above specifications, along with the probability of being a worm, in the worm signature, ERES generates a more specific signature leading to a more accurate detection. In addition, to accelerate the signature extraction process, it combines token extraction with sequence alignment. Evaluations based on multiple polymorphic worms demonstrate that this approach is more acceptable in terms of speed, accuracy, and noise tolerance.