Using a bioinformatics approach to generate accurate exploit-based signatures for polymorphic worms

摘要: In this paper, we propose Simplified Regular Expression (SRE) signature, which uses multiple sequence alignment techniques, drawn from bioinformatics, in a novel approach to generating more accurate exploit-based signatures. We also provide formal definitions of what is ''a specific'' and ''the most signature for polymorphic worm show that the specific generation NP-hard. The involves three steps: reward consecutive substring extractions, noise elimination remove effects, transformation make SRE compatible with current IDSs. Experiments on range worms real-world shellcodes our bioinformatics noise-tolerant as because it extracts characters, like one-byte invariants distance restrictions between invariant bytes, signatures generates are precise than those generated by some other schemes.