Autograph: toward automated, distributed worm signature detection

摘要: Today's Internet intrusion detection systems (IDSes) monitor edge networks' DMZs to identify and/or filter malicious flows. While an IDS helps protect the hosts on its local network from compromise and denial of service, it cannot alone effectively intervene halt reverse spreading novel worms. Generation worm signatures required by IDS--the byte patterns sought in monitored traffic worms--today entails non-trivial human labor, thus significant delay: as operators detect anomalous behavior, they communicate with one another manually study packet traces produce a signature. Yet intervention must occur early epidemic worm's spread. In this paper, we describe Autograph, system that automatically generates for worms propagate using TCP transport. Autograph analyzing prevalence portions flow payloads, uses no knowledge protocol semantics above level. It is designed exhibit high sensitivity (high true positives) specificity (low false positives); our evaluation real DMZ validates achieves these goals. We extend share port scan reports among distributed instances, trace-driven simulation, demonstrate value technique speeding generation Our results elucidate fundamental trade-off between generated signatures.