Polymorphic Worm Detection Using Structural Information of Executables

摘要: Network worms are malicious programs that spread automatically across networks by exploiting vulnerabilities affect a large number of hosts. Because the speed at which to computer populations, countermeasures based on human reaction time not feasible. Therefore, recent research has focused devising new techniques detect and contain network without need supervision. In particular, approaches have been proposed derive signatures analyzing worm-related streams. Most these techniques, however, assume worm code does change during infection process. Unfortunately, can be polymorphic. That is, they mutate as network. To types worms, it is necessary devise able identify similarities between different mutations worm. This paper presents novel technique structural analysis binary allows one mutations. The approach worm's control flow graph introduces an original coloring supports more precise characterization structure. used basis implement detection system resilient many mechanisms evade instruction sequences only.