Automated worm fingerprinting

摘要: Network worms are a clear and growing threat to the security of today's Internet-connected hosts networks. The combination Internet's unrestricted connectivity widespread software homogeneity allows network pathogens exploit tremendous parallelism in their propagation. In fact, modern can spread so quickly, widely, that no human-mediated reaction hope contain an outbreak. In this paper, we propose automated approach for quickly detecting previously unknown viruses based on two key behavioral characteristics - common sequence together with range unique sources generating infections destinations being targeted. More importantly, our called "content sifting" automatically generates precise signatures then be used filter or moderate worm elsewhere network. Using existing novel algorithms have developed scalable content sifting implementation low memory CPU requirements. Over months active use at UCSD, Earlybird prototype system has detected generated all known as well several new which were time identified them. Our initial experience suggests that, wide pathogens, it may practical construct fully defenses even against so-called "zero-day" epidemics.