Please use this identifier to cite or link to this item:
|Title:||Detection of zero-day polymorphic worms using principal component analysis||Author(s):||Chan, Anthony Hing Hung||Issue Date:||2010||Publisher:||IEEE||Related Publication(s):||Proceedings of the 2010 Sixth International Conference on Networking and Services (ICNS)||Start page:||277||End page:||281||Abstract:||
Polymorphic worms pose a big challenge to the Internet security. The difficulty of detection of such a polymorphic worm is that it has more than one instance and very large efforts are needed to capture all these instances and to generate signatures. This paper proposes automatic system for signature generation for zero-day polymorphic worms. We have designed a novel double-honeynet system, which is able to detect new worms that have not been seen before. We apply Principal Component Analysis (PCA) to determine the most significant substrings that are shared between polymorphic worm instances and to use them as signatures. The system is able to generate signatures to match most polymorphic worm instances with low false positives and low false negatives.
|URI:||https://repository.cihe.edu.hk/jspui/handle/cihe/1355||DOI:||10.1109/ICNS.2010.45||CIHE Affiliated Publication:||No|
|Appears in Collections:||CIS Publication|
Show full item record
Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.