Please use this identifier to cite or link to this item: http://hdl.handle.net/10397/64342
Title: Generating simplified regular expression signatures for polymorphic worms
Authors: Tang, Y
Lu, XC
Xiao, B 
Issue Date: 2007
Publisher: Springer
Source: Lecture notes in computer science (including subseries Lecture notes in artificial intelligence and lecture notes in bioinformatics), v. 4610, p. 478-488 How to cite?
Journal: Lecture notes in computer science (including subseries Lecture notes in artificial intelligence and lecture notes in bioinformatics) 
Abstract: It is crucial to automatically generate accurate and effective signatures to defense against polymorphic worms. Previous work using conjunctions of tokens or token subsequence could lose some important information, like ignoring 1 byte token and neglecting the distances in the sequential tokens. In this paper we propose the Simplified Regular Expression (SRE) signature, and present its signature generation method based on the multiple sequence alignment algorithm. The multiple sequence alignment algorithm is extended from the pairwise sequence alignment algorithm, which encourages the contiguous substring extraction and is able to support wildcard string alignment and to preserve the distance of invariant content segment in generated SRE signatures. Thus, the generated SRE signature can express distance information for invariant content in polymorphic worms, which in turn makes even 1 byte invariant content extracted from polymorphic worms become valuable. Experiments on several types of polymorphic worms show that, compared with signatures generated by current network-based signature generation systems (NSGs), the generated SRE signatures are more accurate and precise to match polymorphic worms.
Description: 4th International Conference on Autonomic and Trusted Computing, ATC 2007, Hong Kong, China, July 11-13, 2007
URI: http://hdl.handle.net/10397/64342
ISBN: 978-3-540-73546-5 (print)
978-3-540-73547-2 (online)
ISSN: 0302-9743
EISSN: 1611-3349
DOI: 10.1007/978-3-540-73547-2_49
Appears in Collections:Conference Paper

Access
View full-text via PolyU eLinks SFX Query
Show full item record

Page view(s)

26
Last Week
2
Last month
Checked on Oct 16, 2017

Google ScholarTM

Check

Altmetric



Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.