Automatic signature generation for polymorphic worms by combination of token extraction and sequence alignment approaches

摘要: As modern worms spread quickly; any countermeasure based on human reaction is barely fast enough to thwart the threat. Moreover, because polymorphic could generate mutated instances, they are more complex than non-mutating ones. Currently, content-based signature generation of a challenge for network security. Several classes have been proposed worms. Although previously schemes consider patterns such as 1-byte invariants and distance restrictions, not handle neither large payloads nor big size pool worm instances. prone noise injection attack. We method combine two approaches creating in new way that avoid limitation both approaches. The proposedsignature scheme token extraction multiple sequence alignment, widely used Bioinformatics. This approach provides speed, accuracy, flexibility terms tolerance. evaluations demonstrate these claims.