An automated signature generation approach for polymorphic worms using principal component analysis

Abstract

Internet Worms pose a major threat to Internet infrastructure security. Security experts manually generate the IDS signatures by studying the network traces after a new worm has been released, a rather costly, laborious, and time consuming task. In this paper we propose automated signature generation system for polymorphic worms. We apply Principal Component Analysis (PCA) to determine the most significant substrings that are shared between polymorphic worm instances and use them as signatures. The experimental results show that the PCA has successfully detected polymorphic worms with zero false positives and low false negatives.