Please use this identifier to cite or link to this item:
Title: An automated signature generation approach for polymorphic worms using principal component analysis
Author(s): Chan, Anthony Hing-Hung 
Author(s): Mohammed, M. M. Z. E.
Ventura, N.
Hashim, M.
Bashier, E.
Issue Date: 2011
Publisher: Infonomics Society
Journal: International Journal for Information Security Research 
Volume: 1
Issue: 2
Start page: 45
End page: 52
Internet Worms pose a major threat to Internet infrastructure security. Security experts manually generate the IDS signatures by studying the network traces after a new worm has been released, a rather costly, laborious, and time consuming task. In this paper we propose automated signature generation system for polymorphic worms. We apply Principal Component Analysis (PCA) to determine the most significant substrings that are shared between polymorphic worm instances and use them as signatures. The experimental results show that the PCA has successfully detected polymorphic worms with zero false positives and low false negatives.
DOI: 10.20533/ijisr.2042.4639.2011.0006
CIHE Affiliated Publication: No
Appears in Collections:CIS Publication

Files in This Item:
File Description SizeFormat
View Online117 BHTMLView/Open
SFX Query Show full item record

Google ScholarTM




Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.