Limits of Learning-based Signature Generation with Adversaries

Proceedings of the Symposium on Network and Distributed System Security, NDSS 2008

Volumn , Issue , 2008, Pages

  Venkataraman, Shobha ^a   Blum, Avrim ^a   Song, Dawn ^b  

^a CARNEGIE MELLON UNIVERSITY   (United States)

^b UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EXTRACTION; NETWORK SECURITY;

AUTOMATIC SIGNATURE GENERATIONS; BYTE-SEQUENCES; EXTRACTION ALGORITHMS; EXTRACTION TECHNIQUES; LOW BOUND; PATTERN EXTRACTION; RESEARCH EFFORTS; SIGNATURE GENERATION; SUB-STRINGS; UNIFIED ANALYSIS;

LEARNING ALGORITHMS;

EID: 85180803572     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (33)

1. D. Angluin. Queries and concept learning. Machine Learning, 2(4):319-342, 1988.
2. P. Auer. Learning nested differences in the presence of malicious noise. Theoretical Computer Science, 185(1):159-175, 1997.
3. M. Barreno, B. Nelson, R. Sears, A. D. Joseph, and J. D. Tygar. Can machine learning be secure? In Proceedings of the ACM Symposium on Information, Computer and Communications Security (ASIACCS), 2006.
4. D. Brumley, J. Newsome, D. Song, H. Wang, and S. Jha. Towards automatic generation of vulnerability-based signatures. In Proceedings of the IEEE Symposium on Security and Privacy, 2006.
5. N. H. Bshouty, N. Eiron, and E. Kushilevitz. PAC learning with nasty noise. In Algorithmic Learning Theory, (ALT’99), 1999.
6. S. P. Chung and A. K. Mok. Advanced allergy attacks: Does a corpus really help? In Proceedings of 10th International Symposium on Recent Advances in Intrusion Detection (RAID), 2007.
7. M. Cost, J. Crowcroft, M. Castro, A. Rowstron, L. Zhou, L. Zhang, and P. Barham. Vigilante: End-to-end containment of internet worms. In 20th ACM Symposium on Operating System Principles (SOSP 2005), 2005.
8. M. Costa, M. Castro, L. Zhou, L. Zhang, and M. Peinado. Bouncer: Securing software by blocking bad input. In Proceedings of the 21st Symposium on Operating Systems Principles (SOSP '07), 2007.
9. M. Costa, J. Crowcroft, M. Castro, and A. Rowstron. Can we contain internet worms? In Proceedings of the Third Workshop on Hot Topics in Networks (HotNets-III), 2004.
10. J. Crandall, Z. Su, S. F. Wu, and F. Chong. On deriving unknown vulnerabilities from zero-day polymorphic and metamorphic worm exploits. In Proceedings of the 12th ACM Conference on Computer and Communications Security (CCS), 2005.
11. J. R. Crandall and F. Chong. Minos: Architectural support for software security through control data integrity. In International Symposium on Microarchitecture, 2004.
12. W. Cui, M. Peinado, H. Wang, and M. Locasto. Shieldgen: Automatic data patch generation for unknown vulnerabilities. In Proceedings of the IEEE Symposium on Security and Privacy, 2007.
13. N. Dalvi, P. Domingos, Mausam, S. Sanghai, and D. Verma. Adversarial classification. In Tenth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), 2004.
14. P. Fogla, M. Sharif, R. Perdisci, O. Kolesnikov, and W. Lee. Polymorphic blending attacks. In Proceedings of the 15th Usenix Security Symposium (Security '06), 2006.
15. M. V. Gundy, D. Balzarotti, and G. Vigna. Catch me, if you can: Evading network signatures with web-based polymorphic attacks. In Proceedings of WOOT’07, 2007.
16. M. Kearns and M. Li. Learning in the presence of malicious errors. SIAM Journal on Computing, 22(4):807-837, 1993.
17. H.-A. Kim and B. Karp. Autograph: toward automated, distributed worm signature detection. In Proceedings of the 13th USENIX Security Symposium, 2004.
18. C. Kreibich and J. Crowcroft. Honeycomb - creating intrusion detection signatures using honeypots. In Proceedings of the Second Workshop on Hot Topics in Networks (HotNets-II), 2003.
19. C. Kruegel, E. Kirda, D. Mutz, W. Robertson, and G. Vigna. Polymophic worm detection using structural information of executables. In Proceedings of the 8th International Symposium on Recent Advances in Intrusion Detection (RAID), 2005.
20. Z. Li, M. Shanghi, B. Chavez, Y. Chen, and M.-Y. Kao. Hamsa: Fast signature generation for zero-day polymorphic worms with provable attack resiliance. In Proceedings of the IEEE Symposium on Security and Privacy, 2006.
21. Z. Liang and R. Sekar. Fast and automated generation of attack signatures: A basis for building self-protecting servers. In Proceedings of the 12th ACM Conference on Computer and Communications Security (CCS), 2005.
22. N. Littlestone. Learning quickly when irrelevant attributes abound: A new linear threshold algorithm. Machine Learning, 2(285-318), 1988.
23. D. Lowd and C. Meek. Adversarial learning. In Eleventh ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), 2005.
24. D. Lowd and C. Meek. Good word attacks on statistical spam filters. In Proceedings of Second Conference on Email and Anti-Spam, 2005.
25. J. Newsome, B. Karp, and D. Song. Polygraph: Automatically generating signatures for polymorphic worms. In Proceedings of the IEEE Symposium on Security and Privacy, 2005.
26. J. Newsome, B. Karp, and D. Song. Paragraph: Thwarting signature learning by training maliciously. In Proceedings of the 9th International Symposium on Recent Advances in Intrusion Detection (RAID), 2006.
27. J. Newsome and D. Song. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In Proceedings of the 12th Annual Network and Distributed System Security Symposium (NDSS), 2005.
28. R. Perdisci, D. Dagon, W. Lee, P. Fogla, and M. Sharif. Misleading worm signature generators using deliberate noise injection. In Proceedings of the IEEE Symposium on Security and Privacy, 2006.
29. S. Singh, C. Estan, G. Varghese, and S. Savage. Automated worm fingerprinting. In Proceedings of the 6th ACM/USENIX Symposium on Operating System Design and Implementation (OSDI), 2004.
30. G. E. Suh, J. Lee, and S. Devadas. Secure program execution via dynamic information flow tracking. In Proceedings of ASPLOS, 2004.
31. H. J. Wang, C. Guo, D. Simon, and A. Zugenmaier. Shield: Vulnerability-driven network filters for preventing known vulnerability exploits. In Proceedings of the 2004 ACMSIGCOMM Conference, 2004.
32. K. Wang, J. J. Parekh, and S. J. Stolfo. Anagram: A content anomaly detector resistant to mimicry attack. In Proceedings of the 9th International Symposium on Recent Advances in Intrusion Detection (RAID), 2006.
33. K. Wang and S. J. Stolfo. Anomalous payload-based worm detection and signature generation. In Proceedings of the 8th International Symposium on Recent Advances in Intrusion Detection (RAID), 2005.