Detecting Zero-day Polymorphic Worms with Jaccard Similarity Algorithm.

Malak Abdullah I Almarshad; Mohssen M Z E Mohammed; Al Sakib Khan Pathan

Author(s)

Malak Abdullah I Almarshad College of Computer and Information Sciences, Al-Imam Muhammad Ibn Saud Islamic University, Saudi Arabia

Mohssen M Z E Mohammed College of Computer and Information Sciences, Al-Imam Muhammad Ibn Saud Islamic University, Saudi Arabia

Al Sakib Khan Pathan Department of Computer Science and Engineering, Southeast University, Bangladesh

Abstract

Zero-day polymorphic worms pose a serious threat to the security of Mobile systems and Internet infrastructure. In many cases, it is difficult to detect worm attacks at an early stage. There is typically little or no time to develop a well-constructed solution during such a worm outbreak. This is because the worms act only to spread from node to node and they bring security concerns to everyone using Internet via any static or mobile node. No system is safe from an aggressive worm crisis. However, many of the characteristics of a worm can be used to defeat it, including its predictable behavior and shared signatures. In this paper, we propose an efficient signature generation method based on string similarity algorithms to generate signatures for Zero-day polymorphic worms. Then, these signatures are practically applied to an Intrusion Detection System (IDS) to prevent the network from such attacks. The experimental results show the efficiency of the proposed approach compared to other existing mechanisms.

Publication Details

Page(s) 203-214

DOI DOI not available

Published Journal: International Journal of Communication Networks and Information Security, Volume: 8, Issue: 3, Year: 2016

Request the full text from PASTIC

References

P. Szor. The Art of Computer Virus Research and Defense. Upper Saddle River, NJ: Addison-Wesley Professional, February 13, 2005

“A new era of computer worms: Wireless mobile worms”, 2005 http://searchsecurity.techtarget.com/feature/A-new-era-ofcomputer- worms-Wireless-mobile-worms [last accessed: 22 October, 2016]

F. Perriot and P. Szor, “An Analysis of the Slapper Worm Exploit,” Symantec Security Response, 2003

F. Syed, “Understanding Worms, Their Behaviour and Containing Them,” Project Report, 2009. [Onine]. Available: http://www.cse.wustl.edu/~jain/cse571-09/ftp/worms.pdf [last accessed: 11 March, 2016

J.Newsome,B.Karp,D.Song, 2005.Polygraph: automatically generating signatures for polymorphic worms,2005 IEEE Symposium on Security and Privacy 226 -241

Z.Li,M.Sanghi,Y.Chen,Y.Kao,B.Chavez, 2006.Hamsa: fast signature generation for zero-day polymorphic worms with provable attack resilience,” IEEE Symp. on Sec. and Pri -

L.Cavallaro,A.Lanzi,L.Mayer,M.Monga, 2008.,LISABETH: Automated Content-Based Signature Generator for Zero-day Polymorphic Worms,” Proc. of the fourth int. workshop on Software engineering for secure systems 41 -48

Y.Tang,S.Chen,Issue7, July 2007.,“An Automated Signature-Based Approach against Polymorphic Internet Worms,” IEEE Transactions on Parallel and Distributed Systems 18 879 -892

Y.Tang,S.Chen, 2005.Defending against Internet Worms: A Signature-Based Approach, 2 1384 -1394

Snort, 2015.,org/ [last accessed: 11 March -

J.Newsome,D.Song, 2005.Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software,”,In Proc. of NDSS'05 -

Z.Liang,R.Sekar, .Fast and Automated Generation of Attack Signatures: A Basis for Building Self-Protecting Servers,”,Proc. of the 12th ACM CSS'05 213 -222

Z.Liang,R.Sekar, 2005.Automatic generation of buffer overflow signatures: An approach based on program behavior models,” 21st Annual Computer Security Applications Conference -

M.Costa,J.Crowcroft,M.Castro,A.Rowstron,L.Zhou,L.Zhang,ArticleNo, 2008.,ACM Transactions on Computer Systems 9 -

M.M.Z.E. Mohammed, 2012.Automated Signature Generation for Zero-day Polymorphic Worms Using a Double-honeynet,PhD dissertation -

C.Rong,W.Lu,X.Wang,X.Du,Y.Chen,A.K.H. Tung, 2013.,Efficient and Scalable Processing of String Similarity Join,” IEEE Trans. on Knowledge and Data Engineering 25 2217 -2230

J.Leskovec,A.Rajaraman,J. D.Ullman,2ndedition, November 2014., 9781107077232 -

R.B. Zadeh,A.Goel,Issue1, January 2013.Dimension independent similarity computation,”,The Journal of Machine Learning Research 14 1605 -1626

MATLAB - The Language, .,com [Last accessed: 3 March -

C.Fosnock, 2016.,pdf [last accessed: 11 March -

-, 2016.“Beating the Superbug: Recent Developments in Worms,[last accessed: 11 March -

C.P.Pfleeger,S.L.Pfleeger,J.Margulies, 2015.,Prentice Hall, February 5 -

L.Wang,Z.Li,Y.Chen,Z.Fu,X.Li, .Thwarting ZeroDay Polymorphic Worms With Network-Level Length-Based Signature Generation, 18 53 -66

P.Li,M.Salour,X.Su,Tut, Surv.A survey of internet worm detection and containment, 10 20 -35

I.A.Farag,M.A.Shouman,T.S.Sobh,H.Z.El-Fiqi,Number1, 2009.“Intelligent System for Worm Detection,International Arab Journal of e-Technology 1 58 -67

R.Kaur,M.Singh, 2014.Efficient hybrid technique for detecting zero-day polymorphic worms,2014 IEEE IACC 95 -100

P.Fogla,M.Sharif,R.Perdisci,O.Kolesnikov,W.Lee,ArticleNo, 2006.,” Proc. 15th USENIX-SS 17 06 -

.Low (did not exceed 0, -