Misleading worm signature generators using deliberate noise injection

Proceedings - IEEE Symposium on Security and Privacy

Volumn 2006, Issue , 2006, Pages 17-31

  Perdisci, Roberto ^a,b   Dagon, David ^a   Lee, Wenke ^a   Foglat, Prahlad ^a   Sharif, Monirul ^a  

^a GEORGIA INSTITUTE OF TECHNOLOGY   (United States)

^b UNIVERSITY OF CAGLIARI   (Italy)

Author keywords

[No Author keywords available]

Indexed keywords

DATA FLOW ANALYSIS; GRAPH THEORY; ROBUSTNESS (CONTROL SYSTEMS); SPURIOUS SIGNAL NOISE;

FLOW CLASSIFIERS; POLYGRAPH; SUSPICIOUS FLOWS; WORM SIGNATURES;

ELECTRONIC DOCUMENT IDENTIFICATION SYSTEMS;

EID: 33751051489     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2006.26     Document Type: Conference Paper

References (28)

1. S. Bhatkar, D. C. DuVarney, and R. Sekar. Address obfuscation: An efficient approach to combat a broad range of memory error exploits. In Proceedings of the 12th USENIX Security Symposium, August 2003.
2. T. Detristan, T. Ulenspiegel, Y. Malcom, and M. Underduk. Polymorphic shellcode engine using spectrum analysis. Phrack, Ox3d, 2003.
3. V. Fuller, T. Li, J. Yu, and K. Varadhan. Classless inter-domain routing (cidr): an address assignment and aggregation strategy. http://www.ietf.org/rfc/ rfc1519.txt, 1993.
4. M. Handley and V. Paxson. Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics. In Proceedings of the 10th USENIX Security Symposium, August 2001.
5. G. S. Kc, A. D. Keromytis, and V. Prevelakis. Countering code-injection attacks with instruction-set randomization. In Proceedings of the 10th ACM Conference on Computer and Communications Security, October 2003.
6. H.-A. Kim and B. Karp. Autograph: Toward automated, distributed worm signature detection. In Proceedings of the 13th USENIX Security Symposium, August 2004.
7. O. Kolesnikov, D. Dagon, and W. Lee. Advanced polymorphic worms: Evading ids by blending in with normal traffic. Technical report, Georgia Institute of Technology, 2004. http://www.cc.gatech.edu/~ok/w/ok_pw.pdf.
8. C. Kreibich and J. Crowcroft. Honeycomb: creating intrusion detection signatures using honeypots. In Proceedings of the 2nd ACM Workshop on Hot Topics in Networks, November 2003.
9. Ktwo. ADMmutate Shellcode mutation Engine, http://www.ktwo.ca/ADMmutate- 0.8.4.tar.gz, 2001.
10. Z. Liang and R. Sekar. Automatic generation of buffer overflow attack signatures: An approach based on program behavior models. In Proceedings of the 21st Annual Computer Security Applications Conference, December 2005.
11. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver. Inside the slammer worm. IEEE Security & Privacy, pages 33-39, July-August 2003.
12. D. Moore, C. Shannon, and J. Brown. Code-red: a case study on the spread and victims of an internet worm. In Proceedings of the Internet Measurement Workshop (IMW), November 2002.
13. D. Mutz, O. Vigna, and R. Kemmerer. An experience developing an ids stimulator for the black-box testing of network intrusion detection systems. In Proceedings of the Annual Computer Security Applications Conference (ACSAC), 2003.
14. J. Newsome, B. Karp, and D. Song. Polygraph: Automatically generating signatures for polymorphic worms. In Proceedings of the IEEE Symposium on Security and Privacy, May 2005.
15. J. Newsome and D. Song. Dynamic taint analysis for automatic detection, analysis, and signaturegeneration of exploits on commodity software. In Proceedings of the 12th Network and Distributed System Security Symposium, February 2005.
16. T. H. Ptacek and T. N. Newsham. Denial of service: Eluding network intrusion detection. Technical Report T2R-0Y6, Secure Networks, Inc., 1998.
17. S. S. Response. W32.sasser.worm. http://securityrespone.symantec.com/ avcenter/venc/data/w32.sasser.worm%.html, 2004.
18. S. S. Response. W32.zotob.a. http://securityresponse.symantec.com/ avcenter/venc/data/w32.zotob.a.htm%l, 2005.
19. S. Rubin, S. Jha, and B. P. Miller. Automatic generation and analysis of nids attacks. In Proceedings of the 20th Annual Computer Security Applications Conference (ACSAC), 2004.
20. M. Sedalo. Jempi Scodes: Polymorphic shellcode generator. http://www.shellcode.com.ar/en/proyectos.html, 2003.
21. S. Singh, C. Estan, G. Varghese, and S. Savage. Automated worm fingerprinting. In Proceedings of the ACM/USENIX Symposium on Operating System Design and Implementtion, December 2004.
22. Sniphs. Snot, http://www.stolenshoes.net/sniph/index.html, 2003.
23. D. Song. Fragroute, http://www.monkey.org/~dugsong/fragroute/, 2005.
24. J. Stewart. Phatbot trojan analysis. http://www.lurhq.com/phatbot.html, 2004.
25. Y. Tang and S. Chen. Defending against internet worms: A signature-based approach. In Proceedings of the 24th Annual Conference IEEE INFOCOM 2005, March 2005.
26. G. Vigna, W. Robertson, and D. Balzarotti. Testing network-based intrusion detection signatures using mutant exploits. In Proceedings of the 11th ACM Conference on Computer and Communications Security, 2004.
27. K. Wang and S. J. Stolfo. Anomalous payload-based network intrusion detection. In Proceedings of the 7th Symposium on Recent Advances in Intrusion Detection, September 2004.
28. V. Yegneswaran, J. T. Giffin, P. Barford, and S. Jha. An architecture for generating semantics-aware signatures. In Proceedings of the 14th USENIX Security Symposium, August 2005.