Polymorphic worm detection using structural information of executables

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 3858 LNCS, Issue , 2006, Pages 207-226

  Kruegel, Christopher ^a   Kirda, Engin ^a   Mutz, Darren ^b   Robertson, William ^b   Vigna, Giovanni ^b  

^a VIENNA UNIVERSITY OF TECHNOLOGY   (Austria)

^b UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

Intrusion detection; Network worms; Polymorphic code; Structural analysis

Indexed keywords

GRAPH COLORING TECHNIQUE; INTRUSION DETECTION; NETWORK WORMS; POLYMORPHIC CODES;

CODES (SYMBOLS); COMPUTER CRIME; COMPUTER NETWORKS; COMPUTER WORMS; ELECTRONIC DOCUMENT IDENTIFICATION SYSTEMS; SECURITY OF DATA; STRUCTURAL ANALYSIS;

SECURITY SYSTEMS;

EID: 33745670395     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/11663812_11     Document Type: Conference Paper

References (28)

1. L. Babai annd E. Luks. Canonical Labeling of Graphs. In 15th ACM Symposium on Theory of Computing, 1983.
2. M. Bailey, E. Cooke, P. Jahanian, J. Nazario, and D. Watson. The Internet Motion Sensor: A Distributed Blackhole Monitoring System. In Network and Distributed Systems Symposium (NDSS), 2005.
3. V. Berk, R. Gray, and G. Bakos. Using Sensor Networks and Data Fusion for Early Detection. In SPIE Aerosense Conference, 2003.
4. D. Dagon, X. Qin, G. Gu, W. Lee, J. Grizzard, J. Levin, and Henry O. Honey-Stat: Local Worm Detection Using Honeypots. In 7th International Symposium on Recent Advances in Intrusion Detection (RAID), 2004.
5. T. DeTristan, T. Ulenspiegel, Y. Malcom, and M. von Underduk. Polymorphic Shellcode Engine Using Spectrum Analysis, http://www.phrack.org/ show.php?p=61&a=9.
6. H.-A. Kim and B. Karp. Autograph: Toward Automated, Distributed Worm Signature Detection. In 13th Usenix Security Symposium, 2004.
7. O. Kolesnikov and W. Lee. Advanced Polymorphic Worms: Evading IDS by Blending in with Normal Traffic. Technical report, Georgia Tech, 2004.
8. C. Kreibich and J. Crowcroft. Honeycomb - Creating Intrusion Detection Signatures Using Honeypots. In 2nd Workshop on Hot Topics in Networks, 2003.
9. G. Kruegel, F. Valeur, W. Robertson, and G. Vigna. Static Analysis of Obfuscated Binaries. In 13th Usenix Security Symposium, 2004.
10. C. Linn and S. Debray. Obfuscation of Executable Code to Improve Resistance to Static Disassembly. In ACM Conference on Computer and Communications Security (CCS), 2003.
11. S. Macaulay. ADMmutate: Polymorphic Shellcode Engine, http://www.ktwo.ca/ttsecurity.html.
12. B. McKay. Nauty: No AUTomorphisms, Yes? http://cs.anu.edu.au~bdm/ nauty/.
13. B. McKay. Practical graph isomorphism. Congressus Numerantium, 30, 1981.
14. D. Moore, C. Shannon, G. Voelker, and S. Savage. Internet Quarantine: Requirements for Containing Self-Propagating Code. In IEEE Infocom Conference, 2003.
15. J. Newsome, B. Karp, and D. Song. Polygraph: Automatically Generating Signatures for Polymorphic Worms. In IEEE Symposium on Security and Privacy, 2005.
16. V. Paxson. Bro: A System for Detecting Network Intruders in Real-Time. In 7th Usenix Security Symposium, 1998.
17. M. O. Rabin. Fingerprinting by Random Polynomials. Technical report, Center for Research in Computing Techonology, Harvard University, 1981.
18. M. Roesch. Snort - Lightweight Intrusion Detection for Networks. In Usenix LISA Conference, 1999.
19. S. Singh, C. Estan, G. Varghese, and S. Savage. Automated Worm Fingerprinting. In 6th Symposium on Operating System Design and Implementation (OSDI), 2004.
20. S. Skiena. Implementing Discrete Mathematics: Combinatorics and Graph Theory, chapter Graph Isomorphism. Addison-Wesley, 1990.
21. Sophos. War of the Worms: Top 10 list of worst virus outbreaks in 2004. http://www.sophos.com/pressoffice/pressrel/uk/20041208yeartopten.html.
22. S. Staniford, D. Moore, V. Paxson, and N. Weaver. The Top Speed of Flash Worms. In 2nd ACM Workshop on Rapid Malcode (WORM), 2004.
23. S. Staniford, V. Paxson, and N. Weaver. How to Own the Internet in Your Spare Time. In 11th Usenix Security Symposium, 2002.
24. S. Venkataraman, D. Song, P. Gibbons, and A. Blum. New Streaming Algorithms for Fast Detection of Superspreaders. In Network and Distributed Systems Symposium (NDSS), 2005.
25. N. Weaver, V. Paxson, S. Staniford, and R. Cunningham. A Taxonomy of Computer Worms. In ACM Workshop on Rapid Malcode, October 2003.
26. N. Weaver, S. Staniford, and V. Paxson. Very Fast Containment of Scanning Worms. In 13th Usenix Security Symposium, 2004.
27. D. Whyte, E. Kranakis, and P. van Oorschot. DNS-based Detection of Scanning Worms in an Enterprise Network. In Network and Distributed Systems Symposium (NDSS), 2005.
28. M. Williamson. Throttling Viruses: Restricting Propagation to Defeat Malicious Mobile Code. In 18th Annual Computer Security Applications Conference (ACSAC), 2002.