Graph based signature classes for detecting polymorphic worms via content analysis

摘要: Malicious softwares such as trojans, viruses, or worms can cause serious damage for information systems by exploiting operating system and application software vulnerabilities. Worms constitute a significant proportion of overall malicious infect large number in very short periods. Polymorphic combine polymorphism techniques with self-replicating fast-spreading characteristics worms. Each copy polymorphic worm has different pattern so it is not effective to use simple signature matching techniques. In this work, we propose graph based classification framework content signatures. This aims guide researchers new schemes. We also scheme, Conjunction Combinational Motifs (CCM), on the defined framework. CCM utilizes common substrings copies relation between those through dependency analysis. resilient versions worm. automatically generates signatures worm, triggered partial matches. Experimental results support that good flow evaluation time performance low false positives negatives.