Polymorphic worm detection using double-honeynet

Abstract

Internet worms are increasing every year, and they increasingly threaten the availability and integrity of Internet-based services. Polymorphic worms evade signature-based Intrusion Detection Systems (IDSs) by varying their payload on every infection attempt. In this paper, we propose a system for automated signature generation for Zero-day polymorphic worms. We have designed a novel double-honeynet system, which is able to detect new worms that have not been seen before. The system is based on an efficient algorithm that uses worms binary representation for pattern matching. The system is able to generate accurate signatures for single and multiple worms.