Polymorphic worm detection using strong token-pair signatures

Burak BAYOĞLU; İbrahim SOĞUKPINAR

Makale detayları

Polymorphic worm detection using strong token-pair signatures

Yazarlar:

Burak BAYOĞLU | İbrahim SOĞUKPINAR

Yayıncı:

TUBITAK

Dergi:

Turkish Journal of Electrical Engineering and Computer Science 2009 Vol.17 Issue 2, pp.163-182

Belge Tipi:

Makale

Yayın Tarihi:

1/2009

Belge Dili:

Türkçe

Document ID (Org No.):

2000744024

Sıklık:

İki Aylık

eISSN:

1303-6203

pISSN:

1300-0632

Özet:

 

Malicious software has become a big threat to information  systems, which are widely used to store, transfer and process  information for many critical assets.  Worms are one of the most  harmful network-enabled malicious software that can threaten networks  and applications.  Two main characteristics of worms distinguish them  from the well-known virus programs and as a result are much more  dangerous than the virus programs.  First, they do not need to attach  themselves to an existing program.  Second, worms do not require  end-user interaction to realize the intended attack.  Therefore, a  large number of victims can be infected in a short time.  Polymorphic  worms are a special subset of worm family which are more difficult to  detect.  Polymorphism is the key that facilitates creating different  looking polymorphic worm copies while keeping the original worm code  intact.  Each variant for a polymorphic worm has a different pattern  that it is not effective to use simple signature matching techniques.  In this work, Strong Token-Pair(STP) signature scheme has been  proposed to detect polymorphic worms.  Experimental results support  that STP signatures can be used with low false negative and false  positive rates.

 

Malicious software has become a big threat to information  systems, which are widely used to store, transfer and process  information for many critical assets.  Worms are one of the most  harmful network-enabled malicious software that can threaten networks  and applications.  Two main characteristics of worms distinguish them  from the well-known virus programs and as a result are much more  dangerous than the virus programs.  First, they do not need to attach  themselves to an existing program.  Second, worms do not require  end-user interaction to realize the intended attack.  Therefore, a  large number of victims can be infected in a short time.  Polymorphic  worms are a special subset of worm family which are more difficult to  detect.  Polymorphism is the key that facilitates creating different  looking polymorphic worm copies while keeping the original worm code  intact.  Each variant for a polymorphic worm has a different pattern  that it is not effective to use simple signature matching techniques.  In this work, Strong Token-Pair(STP) signature scheme has been  proposed to detect polymorphic worms.  Experimental results support  that STP signatures can be used with low false negative and false  positive rates.

Makale detayları

Polymorphic worm detection using strong token-pair signatures

Yazarlar: Burak BAYOĞLU | İbrahim SOĞUKPINAR

Yayıncı: TUBITAK

Dergi: Turkish Journal of Electrical Engineering and Computer Science 2009 Vol.17 Issue 2, pp.163-182

Belge Tipi: Makale

Yayın Tarihi: 1/2009

Belge Dili: Türkçe

Document ID (Org No.): 2000744024

Sıklık: İki Aylık

eISSN: 1303-6203

pISSN: 1300-0632

Sayı

Yazarlar:

Burak BAYOĞLU | İbrahim SOĞUKPINAR

Yayıncı:

TUBITAK

Dergi:

Turkish Journal of Electrical Engineering and Computer Science 2009 Vol.17 Issue 2, pp.163-182

Belge Tipi:

Makale

Yayın Tarihi:

1/2009

Belge Dili:

Türkçe

Document ID (Org No.):

2000744024

Sıklık:

İki Aylık

eISSN:

1303-6203

pISSN:

1300-0632