Behavioral Footprinting: A New Dimension to Characterize Self-Propagating Worms

摘要: With increasing speed, virulence, and sophistication, self-propagating worms continue to pose a serious threat the safety of Internet. To effectively identify defend against worms, critical task is characterize worm along multiple dimensions. Content-based fingerprinting well-established dimension for characterization by deriving most representative content sequence as worm’s signature. However, this alone does not capture all aspects may therefore lead incomplete or inaccurate characterization. expand space characterization, paper proposes justifies new dimension, behavioral footprinting. Orthogonal complementary content-based fingerprinting, footprinting characterizes unique behavior during each infection session, which covers probing, exploitation, replication phases session. By modeling step phenotype entire session sequential footprint, we show that captures worm-specific inherently different from normal access vulnerable service. We present advanced analysis techniques extract footprint its traces. Our evaluation with number realworld clearly demonstrates feasibility effectiveness in successfully extracting worm-characterizing footprints experimented worms. Furthermore, comparing our experiments demonstrate uniqueness robustness recognition identification.