An architecture of unknown attack detection system against zero-day worm

摘要: We have introduced the ZASMIN (Zeroday-Attack Signature Management Infrastructure) system, which is developed for novel network attack detection. This system provides early warning at moment attacks start to spread on and block of cyber by automatically generating a signature that could be used security appliance such as IPS. adopted various new technologies -- suspicious traffic monitoring, validation, polymorphic worm recognition, generation unknown Because its hardware-based accelerator also capable deal with giga-bit speed traffic, it can applicable Internet backbone or bottle-neck point high-speed enterprise without any loss traffic. In this paper, after we setup real testbed, analyzed results about detection attack.