ERES: an extended regular expression signature for polymorphic worm detection

摘要: The quick spreading of modern sophisticated polymorphic worms poses a serious threat to the internet security. So far, several signature classes have been proposed face this challenge. Although taking patterns such as 1-byte invariants and distance restrictions into are considered in previous schemes, they do not consider set specific values, which important successful execution worm. In paper, we introduce new type, called ERES (Extended Regular Expression Signature). By considering all above specifications, along with probability being worm, worm signature, generates more leading accurate detection. addition, accelerate extraction process, it combines token sequence alignment. Evaluations based on multiple demonstrate that approach is acceptable terms speed, accuracy, noise tolerance.