Hamsa: fast signature generation for zero-day polymorphic worms with provable attack resilience

摘要: Zero-day polymorphic worms pose a serious threat to the security of Internet infrastructures. Given their rapid propagation, it is crucial detect them at edge networks and automatically generate signatures in early stages infection. Most existing approaches for automatic signature generation need host information are thus not applicable deployment on high-speed network links. In this paper, we propose Hamsa, network-based automated system which fast, noise-tolerant attack-resilient. Essentially, realistic model analyze invariant content allows us make analytical attack-resilience guarantees algorithm. Evaluation based range engines demonstrates that Hamsa significantly outperforms Polygraph (J. Newsome et al., 2005) terms efficiency, accuracy, attack resilience.