Automatic protocol signature generation framework for deep packet inspection

VALUETOOLS 2011 - 5th International ICST Conference on Performance Evaluation Methodologies and Tools

Volumn , Issue , 2011, Pages 291-299

  SzabO, Géza ^a   Turányi, Zoltán ^a   Toka, LászlO ^b,c   Molnár, Sándor ^d   Santos, Alysson ^e  

^a ERICSSON RESEARCH   (Hungary)

^b BUTE   (Hungary)

^c EURECOM   (France)

^d BUDAPEST UNIVERSITY OF TECHNOLOGY AND ECONOMICS   (Hungary)

^e FEDERAL UNIVERSITY OF PERNAMBUCO   (Brazil)

Author keywords

Automatic protocol signature generation; Deep packet inspection; Motif finding

Indexed keywords

BIOINFORMATICS; TOOLS;

APPROXIMATE STRING MATCHING; DEEP PACKET INSPECTION; DEEP PACKET INSPECTION (DPI); MOTIF FINDING; POST-PROCESSING TECHNIQUES; PRE-PROCESSING METHOD; SIGNATURE GENERATION; STRING MATCHING ALGORITHM;

PACKET NETWORKS;

EID: 84889022645     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.4108/icst.valuetools.2011.245606     Document Type: Conference Paper

References (26)

1. A. F. Santos: Automatic Signature Generation, Diploma Thesis, 2009. http://www.cin.ufpe.br/∼tg/2009-t/afs5.pdf.
2. Eric Conrad: Detecting Spam with Genetic Regular Expressions. http//www. sans.org/reading-room!whitepapers/email/detecting-spain-with-genetic- regular-expressions-2006.
3. glam2 - a motif finding tool. http://bioinformatics.org.au/glam2/.
4. L. Toka, G. Szabó, Z. Turányi: Discovering Motifs in Application Flows, Tech Report, 2010. http://www.crysys.hu/∼szabog/TR2OIO. pdf.
5. Lectures in bioinformatics. http://www.cs.otago.ac.nz/cosc348/lectures. html.
6. M. A. Beddoe: Network Protocol Analysis using Bioinformatics Algorithms, 2009. www.4tphi.netPawalters/PI/pi.pdf.
7. M. A. Beddoe: Network Protocol Analysis using Bioinformatics Algorithms, 2009. www.4tphi.netPawalters/PI/pi.pdf.
8. S. Singh, C. Estan, G. Varghese, and S. Savage: The Earlybird System for the Real-time Detection of Unknown Worms, UCSD, Department of Computer Science, Technical Report C52003-076 1,. http://www.cs.unc.eduPjeffay/courses/nidsSOb/ signatures/savage-earlybirdO3.pdf.
9. tcpfiow. http://sourCeforge.net/projeCts/tCpflow/.
10. H. ah Kim. Autograph: Toward automated, distributed worm signature detection. In In Proceedings of the 13th Usenix Security Symposium, pages 271-286, 2004.
11. S. Coull, J. Branch, B. Szymanski, and E. Breimer. Intrusion detection: A bioinformatics approach. In Proceedings of the 19th Annual Computer Security Applications Conference, pages 24-33, 2001.
12. P. Haffner, S. Sen, O. Spatscheck, and D. Wang. Acas: automated construction of application signatures. In MineNet '05, New York, NY, USA, 2005.
13. M. Hanus. Programming with constraints: An introduction by kim marriott and peter j. stuckey, mit press, 1998. J. Funct. Program., 11(2):253-262, 2001.
14. J. Ma, K. Levchenko, C. Kreibich, S. Savage, and G. M. Voelker. Unexpected means of protocol inference. In IMC '06: Proceedings of the 6th ACM SIGCOMM conference on Internet measurement, pages 313-326, New York, NY, USA, 2006. ACM.
15. S. B. Needleman and C. D. Wunsch. A general method applicable to the search for similarities in the amino acid sequence of two proteins. Journal of Molecular Biology, 48(3):443-453, March 1970.
16. J. Newsome, B. Karp, and D. Song. Polygraph: Automatically generating signatures for polymorphic worms. In Proceedings of the 2005 IEEE Symposium on Security and Privacy, pages 226-241, Washington,DC, USA, 2005. IEEE Computer Society.
17. B. Park, Y. J. Won, M. Kim, and J. W. Hong. Towards automated application signature generation for traffic identification. In NOMS, pages 160-167, 2008.
18. W. Scheirer and M. Chuah. The strength of syntax based approaches to dynamic network intrusion Detection. In Information Sciences and Systems, 40th Annual Conference on Volume, March 2006.
19. K. Sjolander, K. Karplus, M. Brown, R. Hughey, A. Krogh, I. Mian, and D. Haussler. Dirichlet mixtures: a method for improved detection of weak but significant protein sequence homology. Computer Applications in the Biosciences, 12(4):327-345, 1996.
20. T. F. Smith and M. S. Waterman. Identification of common molecular subsequences. Journal of Molecular Biology, 147(1):195-197, 1981.
21. G. Szabó, D. Orincsay, I. Szabó, and S. Malomsoky. On the validation of traffic classification algorithms. In Proc. PAM, Cleveland, Ohio, USA, April 2008.
22. K. Takeda. The application of bioinformatics to network intrusion detection. In Security Technology, 2005. CCST '05. 39th Annual 2005 International Carnahan Conference on, pages 130 - 132, 11-14 2005.
23. Y. Tang, B. Xiao, and X. Lu. Using a bioinformatics approach to generate accurate exploit-based signatures for polymorphic worms. Computers & Security, 28(8):827-842, 2009.
24. G. Thijs, K. Marchal, M. Lescot, S. Rombauts, B. Dc Moor, P. Rouzé, and Y. Moreau. A gibbs sampling method to detect over-represented motifs in the upstream regions of co-expressed genes. In RECOMB '01: Proceedings of the fifth annual international conference on Computational biology, pages 305-312, New York, NY, USA, 2001. ACM.
25. V. V. Vazirani. Approximation algorithms. Springer-Verlag New York, Inc., New York, NY, USA, 2001.
26. M. Ye, K. Xu, J. Wu, and H. Po. Autosig-automatically generating signatures for applications. In CIT (2), pages 104-109. IEEE Computer Society, 2009.