Abstract:The fast spread of a worm is a great challenge to Internet security. Most current defense systems use a signature matching approach while most signatures are developed manually. It is difficult to catch a variety of new worms promptly. An efficient worm defense system is designed and implemented to provide early warning at the moment the worms start to spread in the network and to contain or slow down the spread of the worm by automatically extracting a signature that could be used by firewalls or Intrusion Prevention Systems. Several recent efforts to automatically extract worm signatures from Internet traffic have been done, but the efficiency is an unsolved problem especially in real high-speed network. In this paper, we proposed an efficient worm defense system based signature extraction. The input of the system is all traffic crossing an edge network and its output is a database of worm signatures which can be used by content-based defense. There are three main stages to extract signatures from network traffic. First, a clustering stage uses multidimensional traffic mining based IP header to identify significant traffic volume. We propose a binary clustering algorithm and this leaves a preferred policy to improve the front traffic filter, which can reduce the traffic to be processed and enhance its purity. After clustering, nonsignificant traffic volume is stored in an innocuous packet pool and significant traffic volume is further classified using address dispersion as suspicious or innocuous. After this stage, only a small portion of the packets captured from the edge network are analyzed in third stage, signature extraction. A position-aware signature generation method based bloom filter is proposed to extract more accurate signatures with less CPU time and memory consumption. To minimize false positives, the signatures will be verified based on the innocuous packet pool. Both trace data and tcpdump data are used to test the prototype system. Experiment results show that the system can efficiently filter through suspicious traffic with high purity and extract more accurate signature, which can well support popular content-based defense system such as Snort.

AntiWorm NPU-based Parallel Bloom Filters for TCP/IP Content Processing in Giga-Ethernet LAN

AntiWorm NPU-based Parallel Bloom Filters in Giga-Ethernet LAN.

Cooperation System of Worm Detection and Quarantine in Real Time

Implementation of Network Processor-Based Content Filtering

Design and Implementation of Network Worm Detection System for Internal Network

Embedded network processor based parallel intrusion detection

Fast Parallelized TCP/IP Stack for High-Speed Network Intrusion Detection Systems

The Design and Implementation of High Speed Anti-Worm Engine Based on HBM Algorithm

Network Traffic Flow Analysis And Its Application In Early Detection Of Internet Worms

Internet-Worm Detecting System Based on ISP Distributed

Stratified Analysis of Network Flows and Its Application to Early Detection of Internet Worms

Anti-worm Based Defensive scheme for P2P Worm

An Efficient Worm Defense System Based Signature Extraction

Handling high speed traffic measurement using network processors

Design and Implementation of Bro-based Worm Detection System

Mining Network Traffic for Worm Signature Extraction

Research on Worm Epidemics and Visualization in High-Speed Links

SWorD : A S imple Wor m D etection Scheme

Practice Of Parallelizing Network Applications On Multi-Core Architectures

Towards High-Performance Network Intrusion Prevention System on Multi-core Network Services Processor

Fast Detection of Worm Infection for Large-Scale Networks