원문정보
초록
영어
In recent times, malicious objects have significantly increased in volume by many folds. Firewall, anti-virus (AV) or signature based intrusion detection systems (IDSs) all are found effective but only for known malicious objects. In that sense, unknown malicious objects are more dangerous. There are many techniques like honeypots, honeynets or anomaly based IDSs which are capable enough to identify these new malicious objects. This paper introduces a technique to develop a library not only for past and present attacks but also for future attacks, so that signature based IDSs not only detect known malicious objects but the unknown and future malicious objects as well. In our approach, with the help of a series of four algorithms, we show a way to develop all possible variants of each detected malicious object and finally update the library with these variants in order to empower it with future attacks.
목차
1. Introduction
2. Proposed Architecture
3. Proposed Algorithms
3.1. Signature Creation Algorithm
3.2. Signature Compression Algorithm
3.3. Data Mining Inspired Algorithm
3.4. Variant Creation Algorithm
4. Experiments
4.1. Part One: Compressed Signature of a Boot Sector Virus
4.2. Part Two: Compressed Signature of a Set of Benign Programs
4.3. Part Three: Creation of Final Signature and Variants Generation of Kilroy Virus
5. Conclusion
References