WormShield: Fast Worm Signature Generation with Distributed Fingerprint Aggregation

摘要: Fast and accurate generation of worm signatures is essential to contain zero-day worms at the Internet scale. Recent work has shown that signature can be automated by analyzing repetition substrings (that is, fingerprints) their address dispersion. However, early stage a outbreak, individual edge networks are often short enough exploits for generating signatures. This paper presents both theoretical experimental results on collaborative system (WormShield) employs distributed fingerprint filtering aggregation over multiple networks. By real-life traces, we discovered fingerprints in background traffic exhibit Zipf-like distribution. Due this property, reduces amount significantly. WormShield monitors utilize new tree (DAT) compute global statistics scalable load-balanced fashion. We simulated spectrum scanning including CodeRed Slammer using realistic configurations about 100,000 On average, 256 generate CodeRedl-v2 135 times faster than same number isolated monitors. In addition speed gains, observed less 100 false out 18.7-Gbyte yielding very low false-positive rate. Each monitor only generates 0.6 kilobit per second traffic, which 0.003 percent 18 megabits link sniffed. These demonstrate offers distinct advantages accuracy, scalability large-scale containment.