Hamsa: Fast signature generation for zero-day polymorphic worms with provable attack resilience

Zhichun Li*, Manan Sanghi, Yan Chen, Ming-Yang Kao, Brian Chavez

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contribution

183 Scopus citations

Abstract

Zero-day polymorphic worms pose a serious threat to the security of Internet infrastructures. Given their rapid propagation, it is crucial to detect them at edge networks and automatically generate signatures in the early stages of infection. Most existing approaches for automatic signature generation need host information and are thus not applicable for deployment on high-speed network links. In this paper, we propose Hamsa, a network-based automated signature generation system for polymorphic worms which is fast, noise-tolerant and attack-resilient. Essentially, we propose a realistic model to analyze the invariant content of polymorphic worms which allows us to make analytical attack-resilience guarantees for the signature generation algorithm. Evaluation based on a range of polymorphic worms and polymorphic engines demonstrates that Hamsa significantly outperforms Polygraph [16] in terms of efficiency, accuracy, and attack resilience.

Original languageEnglish (US)
Title of host publicationProceedings - 2006 IEEE Symposium on Security and Privacy, S+P 2006
Pages32-46
Number of pages15
DOIs
StatePublished - Nov 21 2006
Event2006 IEEE Symposium on Security and Privacy, S and P 2006 - Berkeley, United States
Duration: May 21 2006May 24 2006

Publication series

NameProceedings - IEEE Symposium on Security and Privacy
Volume2006
ISSN (Print)1081-6011

Other

Other2006 IEEE Symposium on Security and Privacy, S and P 2006
CountryUnited States
CityBerkeley
Period5/21/065/24/06

ASJC Scopus subject areas

  • Engineering(all)

Fingerprint Dive into the research topics of 'Hamsa: Fast signature generation for zero-day polymorphic worms with provable attack resilience'. Together they form a unique fingerprint.

  • Cite this

    Li, Z., Sanghi, M., Chen, Y., Kao, M-Y., & Chavez, B. (2006). Hamsa: Fast signature generation for zero-day polymorphic worms with provable attack resilience. In Proceedings - 2006 IEEE Symposium on Security and Privacy, S+P 2006 (pp. 32-46). [1623999] (Proceedings - IEEE Symposium on Security and Privacy; Vol. 2006). https://doi.org/10.1109/SP.2006.18