Catch me, if you can: evading network signatures with web-based polymorphic worms

摘要: Polymorphic worms are self-replicating malware that change their representation as they spread throughout networks in order to evade worm detection systems. A number of approaches detect polymorphic have been proposed. These use samples a (and benign traffic well) derive signature can all instances the without producing excessive false positives. Even though these systems claim be able generate signatures for any type worm, examples used show ability based on exploits target memory corruption vulnerabilities. In this paper, we how different class worms, namely those web vulnerabilities and scripting languages, much harder than "traditional" worms. We developed engine PHP code tested state-of-the-art tools worm. The results our experiments PHP-based would successfully existing generation