Efficient hybrid technique for detecting zero-day polymorphic worms

摘要: This paper presents an efficient technique for detecting zero-day polymorphic worms with almost zero false positives. Zero-day not only exploit unknown vulnerabilities but also change their own representations on each new infection or encrypt payloads using a different key per infection. Thus, there are many variations in the signatures same worm, making fingerprinting very difficult. With ability to rapidly propagate, these increasingly threaten Internet hosts and services. If detected contained at right time, they can potentially disable wreak serious havoc. So detection of is paramount importance.