Worm Signatures Research Articles

Detecting Zero-day Polymorphic Worms with Jaccard Similarity Algorithm

Zero-day polymorphic worms pose a serious threat to the security of Mobile systems and Internet infrastructure. In many cases, it is difficult to detect worm attacks at an early stage. There is typically little or no time to develop a well-constructed solution during such a worm outbreak. This is because the worms act only to spread from node to node and they bring security concerns to everyone using Internet via any static or mobile node. No system is safe from an aggressive worm crisis. However, many of the characteristics of a worm can be used to defeat it, including its predictable behavior and shared signatures. In this paper, we propose an efficient signature generation method based on string similarity algorithms to generate signatures for Zero-day polymorphic worms. Then, these signatures are practically applied to an Intrusion Detection System (IDS) to prevent the network from such attacks. The experimental results show the efficiency of the proposed approach compared to other existing mechanisms.

Review Study on Different Attack Strategies of Worm in a Network

In today’s era Internet worm is a giant threat to the network infrastructure. Although there are different strategies to sense those hazard at early stages. They detect using some signature based approach. But when novel attacks come into the structure, it is very hard to detect them as they do not have any previous signature. For those some signature based methodology is used. In our work we have reviewed different strategies of internet worm detection and prevention and this article also explores the existing techniques to automate signatures for network worms.

A Worm Detection System Based on Deep Learning

In today's cyber world, worms pose a great threat to the global network infrastructure. In this paper, we propose a worm detection system based on deep learning. It includes two main modules: one worm detection module based on a convolutional neural network (CNN) and one automatic worm signature generation module based on a deep neural network (DNN). In the CNN-based worm detection module, we propose three kinds of data preprocessing methods: frequency processing, frequency weighted processing, and difference processing, and use CNN to train the model for worm detection. In the DNN-based worm signature generation module, there are two phrase: DNN is firstly utilized for training the model with worm payloads and their corresponding signatures as input in the training phrase. After worm payloads are fed into the trained DNN model in the test phrase, worm signatures are generated by our proposed Signature Beam Search algorithm. In the experiment, we firstly analyzed the impact of different data preprocessing methods and the number of convolution-pooling layers in the CNN model on the worm detection performance. Then we analyzed the effects of different signatures in the DNN algorithm on the automatic generation of worm signatures. Experiments show that the generated signatures have a good detection performance.

Digesting Network Traffic for Forensic Investigation Using Digital Signal Processing Techniques

One of the most important practices of cybercrime investigations is to search a network traffic history for an excerpt of traffic, such as the disclosed information of an organization or a worm signature. In post-mortem investigations, criminals and targets are detected by attributing the excerpt to payloads of traffic flows. Since it is impossible to store the high volume of data related to long-term traffic history, payload attribution systems (PAS) based on storing a compact digest of traffic using Bloom filters have been presented in the literature. In these systems, querying the stored digest for an excerpt results in a low number of suspects instead of certain criminals. In this paper, we present a different PAS which is based on simple and widespread digital signal processing techniques. Our traffic digesting scheme has been inspired by DSP-based compression algorithms. The proposed payload attribution system, named DSPAS, not only results in a low false positive rate but also outperforms previous schemes in response to wildcard queries which are essentially applicable for complex excerpts such as the signature of polymorphic worms. Our theoretical analysis and practical evaluations show that DSPAS results in a significantly lower false positive rate and also a lower processing time for wildcard queries in comparison to previous works. Moreover, our PAS can prevent a malicious insider from evading the PAS by its ability to find strings similar to a queried excerpt.

ERES: an extended regular expression signature for polymorphic worm detection

The quick spreading of modern sophisticated polymorphic worms poses a serious threat to the internet security. So far, several signature classes have been proposed to face this challenge. Although taking patterns such as 1-byte invariants and distance restrictions into signature classes are considered in the previous schemes, they do not consider the set of specific values, which are important in the successful execution of a worm. In this paper, we introduce a new signature type, called ERES (Extended Regular Expression Signature). By considering all the above specifications, along with the probability of being a worm, in the worm signature, ERES generates a more specific signature leading to a more accurate detection. In addition, to accelerate the signature extraction process, it combines token extraction with sequence alignment. Evaluations based on multiple polymorphic worms demonstrate that this approach is more acceptable in terms of speed, accuracy, and noise tolerance.

CC2: Defending Hybrid Worm on Mobile Networks with Two‐Dimensional Circulation Control

As the hybrid worm can propagate by both personal social interactions and wireless communications, it has been identified as one of the most severe threats to the mobile Internet. This problem is expected to become worse with the boom of social applications and mobile services. In this work, we study the propagation dynamics of hybrid worms and propose a systematic countermeasure. The system maintains a set of community structure which describes the high‐speed infection zone of worms and contains worm propagation by distributing the worm signature to the guard nodes selected from the periphery of each community. For those nodes that are geographically close but located in different communities , we evaluate the communication security between them based on the observed infection history and limit communications between insecure ones to avoid the worm spreading across communities. We also design an efficient worm signature forwarding strategy that enables most nodes in the network to reach an immune state before being infected by the worm. Extensive real‐trace driven simulations verify the feasibility and effectiveness of the proposed methods.

Signature-Based Malware Detection Using Sequences of N-grams

The focus of our study is on one set of malware family known as Brontok worms. These worms have long been a huge burden to most Windows-based user platforms. A prototype of the antivirus was able to scan files and accurately detect any traces of the Brontok malware signatures in the scanned files. In this study, we developed a detection model by extracting the signatures of the Brontok worms and used an n-gram technique to break down the signatures. This process makes the task to remove redundancies between the signatures of the different types of Brontok malware easier. Hence, it was used in this study to accurately differentiate between the signatures of both malicious and normal files. During the experiment, we have successfully detected the presence of Brontok worms while correctly identifying the benign ones. The techniques employed in the experiment provided some insight on creating a good signature-based detector, which could be used to create a more credible solution that eliminates any threats of old malware that may resurface in the future.

Design and evaluation of a system for network threat signatures generation

The paper addresses a problem of cybersecurity that plays the strategic role in modern computer networks. The attention is focused on the usage of pre-generated signatures to detect malicious content in network traffic. Given the rapid propagation of computer threats, it is crucial to detect them in early stage of an infection. Therefore, the main challenge is to design and develop efficient mechanisms for generation of their signatures. Nowadays, manually generated signatures of computer worms are commonly used for identifying malicious activity in the networks. Creation of such signatures often requires hours or even days of work, while the time limit for signatures generation for active worms is measured in minutes, at the most. Thus, attack trends change very fast, making it impossible to keep up with manual signature engineering and an automatic generation of signatures seems to be the only reasonable solution. In this paper, we investigate a problem of automatic generation of signatures of zero-day polymorphic worms. We developed an efficient algorithm for token extraction and a novel method for automatic multi-token signature composition. Our method employs a genetic algorithm to produce signatures accurately matching network worms. We designed and developed a framework for offline generation of signatures implementing our method. The efficiency and utility of the system was verified through simulation. The test cases were carried out on data combining real flows and synthetic flows imitating real malicious Internet traffic. The results of experiments performed for selected polymorphic worms demonstrate that our framework may be successfully used to create the high quality signatures in a reasonable time.

Survey of Polymorphic Worm Signatures

Worms are self –replicating, fast moving malicious codes, capable of spreading themselves without human interaction. It’s a weapon of choice for those, who like to launch destructive attacks on network or internet as a whole. Recently there emerge more sophisticated worms such as polymorphic worm which vary their payload in every infection attempt. Polymorphic worms have more than one mutated instances. It is very important to detect and prevent such worms quickly and accurately at their early phase of infection. There are several worm detection and containment methods available. This paper surveys recent automated signature based detection of polymorphic worms and presents a classification for various signature approaches. There are two main categories of worm signatures, exploit specific and vulnerability driven. Both categories of signature are either network-based or host based. Each signature generation scheme is described and discussed in appropriate category. We analyze and compare different signature schemes. The paper concludes with challenge and scope of future research directions.

An Automatic Extraction Approach of Worm Signatures Based on Behavioral Footprint Analysis

This paper presents an automatic extraction approach of worm signatures based on behavioral footprint analysis. Firstly, the suspicious worm traffic is detected based on worm behavior and is an instance of the Sequential Change Point Detection. To make the detection mechanism insensitive to site and access pattern, a non-parametric Cumulative Sum (CUSUM) method is applied, thus making the detection mechanism much more generally applicable and its deployment much easier. Secondly, worm behavioral footprint is defined and classified. The chronicle formalism is applied to correlate the footprint in suspicious worm traffic. Finally, worm signatures are extracted and ascertained by the evaluation function. The experiment shows that the approach can extract worm signatures effectively and accurately. There is a conclusion that worm behavioral footprint can't identify the worm accurately, but it helps to locate worm signatures, so signatures can be extracted effectively.

The Effects of Different Representations on Static Structure Analysis of Computer Malware Signatures

The continuous growth of malware presents a problem for internet computing due to increasingly sophisticated techniques for disguising malicious code through mutation and the time required to identify signatures for use by antiviral software systems (AVS). Malware modelling has focused primarily on semantics due to the intended actions and behaviours of viral and worm code. The aim of this paper is to evaluate a static structure approach to malware modelling using the growing malware signature databases now available. We show that, if malware signatures are represented as artificial protein sequences, it is possible to apply standard sequence alignment techniques in bioinformatics to improve accuracy of distinguishing between worm and virus signatures. Moreover, aligned signature sequences can be mined through traditional data mining techniques to extract metasignatures that help to distinguish between viral and worm signatures. All bioinformatics and data mining analysis were performed on publicly available tools and Weka.

A Behaviour based Framework for Worm Detection

Increasing threats from worms in the internet continue to be a challenge for current content-based Network Intrusion Detection Systems (NIDS). Worms use different obfuscation techniques (You & Yim 2010) to evade detection and if the worm's signature is not previously known, such systems fail. This paper proposes the use of behavioral signatures for network intrusion detection. The different infection phases exhibited by a worm can be used to characterize its network behaviour. Such behaviour of worms can be captured in the proposed scheme by using behavioural signatures.

Graph based signature classes for detecting polymorphic worms via content analysis

Malicious softwares such as trojans, viruses, or worms can cause serious damage for information systems by exploiting operating system and application software vulnerabilities. Worms constitute a significant proportion of overall malicious software and infect a large number of systems in very short periods. Polymorphic worms combine polymorphism techniques with self-replicating and fast-spreading characteristics of worms. Each copy of a polymorphic worm has a different pattern so it is not effective to use simple signature matching techniques. In this work, we propose a graph based classification framework of content based polymorphic worm signatures. This framework aims to guide researchers to propose new polymorphic worm signature schemes. We also propose a new polymorphic worm signature scheme, Conjunction of Combinational Motifs (CCM), based on the defined framework. CCM utilizes common substrings of polymorphic worm copies and also the relation between those substrings through dependency analysis. CCM is resilient to new versions of a polymorphic worm. CCM also automatically generates signatures for new versions of a polymorphic worm, triggered by partial signature matches. Experimental results support that CCM has good flow evaluation time performance with low false positives and low false negatives.

Behaviour Based Worm Detection and Signature Automation

Problem statement: A worm is a malicious piece of code that self-prop agates, often via network connections, to exploit security flaws in c omputers connected through the network. In general, worms do not need any human intervention to propagate and are considered a real threat to network assets and the properties of organizations. An Intr usion Detection Systems (IDSs) are employed to detect the presence of the worms in the network. Approach: This study proposed a new behaviour- based worm detection and signature automation approach that consists of scanning characteristics to find vulnerable hosts and indicate the correlation between an infected host and potential destination hosts. Results: This approach can be distinguish between network s canning (random and sequential TCP and UDP worm scanning) triggered by infected and non-infected hosts. In addition, the ability to detect the worms based on its behaviours. Conclusion: Identifying network worms at an early stage can increase the protection of network services and vulnerable hosts.

SAS: semantics aware signature generation for polymorphic worm detection

String extraction and matching techniques have been widely used in generating signatures for worm detection, but how to generate effective worm signatures in an adversarial environment still remains a challenging problem. For example, attackers can freely manipulate byte distributions within the attack payloads and thus inject well-crafted noisy packets to contaminate the suspicious flow pool. To address these attacks, we propose SAS, a novel Semantics Aware Statistical algorithm for automatic signature generation. When SAS processes packets in a suspicious flow pool, it uses data flow analysis techniques to remove non-critical bytes. We then apply a hidden Markov model (HMM) to the refined data to generate state-transition-graph-based signatures. To our best knowledge, this is the first work combining semantic analysis with statistical analysis to automatically generate worm signatures. Our experiments show that the proposed technique can accurately detect worms with concise signatures. Moreover, our results indicate that SAS is more robust to the byte distribution changes and noise injection attacks compared to Polygraph and Hamsa.

A Modified Two-phase Knowledge Acquisition Algorithm to Construct Worm Knowledge Base

With the rapid development of Internet, the worm can spread and infect other computers quickly. Lots of variants are evolved too fast to hardly detect them before crafting the specific signatures in most anti-virus software and hardware. Since most of worm technological documents are nonstructured, the discovery of knowledge by data mining is becoming not easy. In this paper, we modify two-phase knowledge acquisition via adding Hierarchical Grids Relation Adjustment algorithm to adjust hierarchical worm knowledge hierarchy. We propose sibling, parent-child, and ancestordescendent relations to guide experts to easily extract the conflict relations in each level of grid. Through the updated grid hierarchy, more exact and efficient worm distinguish rules can be obtained for understanding the worm hierarchy. Also, a worm immune system is implemented here to help users diagnose their vulnerable systems and teach users how to defend threat of worms. Moreover, the system can learn the signatures of variant worms by interacting with experts to easily incremental learn the knowledge of variant worms.

Signature Tree Generation for Polymorphic Worms

Network-based signature generation (NSG) has been proposed as a way to automatically and quickly generate accurate signatures for worms, especially polymorphic worms. In this paper, we propose a new NSG system-PolyTree, to defend against polymorphic worms. We observe that signatures from worms and their variants are relevant and a tree structure can properly reflect their familial resemblance. Hence, in contrast to an isolated view of generated signatures in previous approaches, PolyTree organizes signatures extracted from worm samples into a tree structure, called signature tree, based on the formally defined more specific” relation of simplified regular expression signatures. PolyTree is composed of two components, signature tree generator and signature selector. The signature tree generator implements an incremental signature tree generation algorithm from worm sample clustering, up-to-date signature refinement to efficient tree construction. The incremental signature tree construction gives insight on how the worm variants evolve over time and allows signature refinement upon a new worm sample arrival. The signature selector chooses a set of signatures for worm detection from a benign traffic pool and the current signature tree constructed by the signature tree generator. Experiments show that PolyTree cannot only generate accurate signatures for polymorphic worms with noise, but these signatures are well organized in the signature tree to reflect the inherent relations of worms and their variants.

WORM DETECTION USING HONEYPOTS FOR WINDOWS ENVIRONMENT

Recent cybersecurity incidents suggest that internet worms can spread so fast that in-time human-mediated reaction is not possible, and therefore initial response to cyberattacks has to be automated. In this paper we present a system for detecting known and unknown worms using honeypots. The proposed system detects worms by monitoring connection activity and watching for patterns of traffic that are expressions of some of the essential characteristics of worm behavior. The implementation is a signature-based detection as a first tier and an anomaly-based as a second tier in the detection process. At a network's gateway, the proposed system runs a vantage point from which all traffic into and out of the network is visible. The system employs a honeypot to capture traffic, after discarding whitelisted patterns; as it automatically generates worm signatures which are matched with the signatures of the known worms stored in original database. When a signature is matched, the system reports it by issuing an alert that also includes the IP addresses involved in the transaction. Otherwise, the system monitors the changes in the performance of CPU, RAM and changes in files in the gateway which are considered as indicators to the presence of worms. The proposed system was evaluated using a dataset collected from internet for several days, and potentially showed good results for detecting and collecting information about worms from local network. It was noticed that the performance was increased up to 23% more than other systems that uses honeypots.

SISG: self‐immune automated signature generation for polymorphic worms

Purpose – The purpose of this paper is to propose a self‐immune automated signature generation (SISG) for polymorphic worms which is able to work well, even while being attacked by any types of malicious adversary and produces global‐suited signatures other than local‐suited signatures for its distributed architecture. Through experimentations, the method is thereafter evaluated.Design/methodology/approach – The ideal worm signature exist in each copy of the corresponding worm, but never in other worm categories and normal network traffic. SISG compares each worm copy and extract the same components, then produces the worm signature from the components which must achieve low‐false positive and low‐false negative. SISG is immune from the most attacks by filtering the harmful noise made by malicious adversaries before signature generation.Findings – NOP sled, worm body and descriptor are not good to be signature because they can be confused intricately by polymorphic engines. Protocol frames may not suit to...

Using a bioinformatics approach to generate accurate exploit-based signatures for polymorphic worms

In this paper, we propose Simplified Regular Expression (SRE) signature, which uses multiple sequence alignment techniques, drawn from bioinformatics, in a novel approach to generating more accurate exploit-based signatures. We also provide formal definitions of what is “a more specific” and what is “the most specific” signature for a polymorphic worm and show that the most specific exploit-based signature generation is NP-hard. The approach involves three steps: multiple sequence alignment to reward consecutive substring extractions, noise elimination to remove noise effects, and signature transformation to make the SRE signature compatible with current IDSs. Experiments on a range of polymorphic worms and real-world polymorphic shellcodes show that our bioinformatics approach is noise-tolerant and as that because it extracts more polymorphic worm characters, like one-byte invariants and distance restrictions between invariant bytes, the signatures it generates are more accurate and precise than those generated by some other exploit-based signature generation schemes.