Massive data mining for polymorphic code detection

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 3685 LNCS, Issue , 2005, Pages 448-453

  Payer, Udo ^a   Teufl, Peter ^a   Kraxberger, Stefan ^a   Lamberger, Mario ^a  

^a Institute for Applied Information Processing and Communications   (Austria)

Author keywords

[No Author keywords available]

Indexed keywords

CODES (SYMBOLS); GENETIC ALGORITHMS; MARKOV PROCESSES; MATHEMATICAL MODELS; NEURAL NETWORKS; SELF ORGANIZING MAPS; STATISTICAL METHODS;

INTRUSION DETECTION MECHANISMS; POLYMORPHIC CODE DETECTION; POLYMORPHIC SHELLCODE; STATISTICAL METHODOLOGIES;

DATA MINING;

EID: 33646144851     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/11560326_38     Document Type: Conference Paper

References (20)

1. AlephOne: Smashing the stack for fun and profit. Phrack Magazine 49(14) (1996)
2. Biles, S.: Detecting the Unknown with Snort and the Statistical Packet Anomaly Detection Engine ( SPADE ). http://www.computersecurityonline.com/spade/ SPADE.pdf retrieved on (2005)
3. Bishop, C.M.: Neural networks for pattern recognition. The Clarendon Press Oxford University Press, New York. With a foreword by Geoffrey Hinton (1995)
4. CLET team: Polymorphic shellcode engine. Phrack Magazine 61(9) (2003)
5. Duda, R., Hart, P., Stork, D.: Pattern classification. Wiley-Interscience, New York, second edition (2001)
6. Helsinki University of Technology. Som toolbox for matlab. http://www.cis.hut.fi/ projects/somtoolbox/ (2005)
7. K2. Admutate 0.8.4. http://www.ktwo.ca. Retrieved (2004)
8. Kohonen, T.: Self-Organizing Maps. Springer (2001)
9. Kraxberger, S., Payer, U.: Markov Model for Polymorphic Shellcode Detection, accepted at INC 2005. (2005)
10. Mathworks. Neural network toolbox. http://www.mathworks.com/products/ neuralnet/ (2004)
11. NASM SourceForge Project, http://nasm.sourceforge.net (2005)
12. Pasupulati, A. Coit, Levitt, J., Wu, K., Li, S.F., Kuo, S.H., Fan, J.C.: Buttercup: on network-based detection of polymorphic buffer overflow vulnerabilities. Network Operations and Management Symposium, 2004. NOMS 2004. IEEE/IFIP, Vol. 1 (2004) 235-248
13. Payer, U., Teufl, P., Lamberger, M.: Hybrid Engine for Polymorphic Shellcode Detection, accepted at DIMVA (2005)
14. Payer, U., Teufl, P., Lamberger, M.: Traffic classification using Self-Organizing Maps, accepted at INC 2005 (2005)
15. Roweis, S.: Levenberg-marquardt optimization. http://www.cs.toronto.edu/ ~roweis/notes/lm.pdf (2005)
16. Ruiu, D.: Snort preprocessor - Multi-architecture mutated NOP sled detector. http://cansecwest.com/spp_fnord.c (2005)
17. Sedalo, M.: Polymorphic Shellcode Engine, http://www.shellcode.com.ar (2004)
18. Snort. Open Source Network Intrusion Detection System, http://www.snort.org (2005)
19. Toth, T., Kruegel, Ch.: Accurate buffer overflow detection via abstract payload execution. RAID 2002, Lecture Notes in Computer Science, Vol. 2516 (2002) 274291
20. Weisstein, E.W.: Markov Chain. From MathWorld-A Wolfram Web Resource. http://mathworld.wolfram.com/MarkovChain.html