Thwarting Zero-Day Polymorphic Worms With Network-Level Length-Based Signature Generation

摘要: It is crucial to detect zero-day polymorphic worms and generate signatures at network gateways or honeynets so that we can prevent from propagating their early phase. However, most existing network-based are specific exploit be easily evaded. In this paper, propose generating vulnerability-driven level without any host-level analysis of worm execution vulnerable programs. As the first step, design a length-based signature generator (LESG) for exploiting buffer overflow vulnerabilities. The generated intrinsic overflows, very difficult attackers evade. We further prove attack resilience bounds even under worst-case attacks with deliberate noise injection. Moreover, LESG fast noise-tolerant has efficient matching. Evaluation based on real-world vulnerabilities various protocols real traffic demonstrates promising in achieving these goals.