Network-basedandAttack-resilient：基于网络的攻击的弹性.pdfVIP

Network-based and Attack-resilient Length Signature Generation for Zero-day Polymorphic Worms Zhichun Li, Lanjia Wang†, Yan Chen and Zhi (Judy) Fu‡ Northwestern University, Evanston, IL, USA †Tsinghua University, Beijing, China ‡Motorola Labs, Schaumburg IL, USA Abstract—It is crucial to detect zero-day polymorphic worms vulnerable program for analysis. However, such host-level and to generate signatures at the edge network gateways or hon- schemes are too slow to counteract the worms that can eynets so that we can prevent the worms from propagating at their propagate at exponential speed. Given the rapid growth of early phase. However, most existing network-based signatures generated are not vulnerability-based and can be easily evaded by network bandwidth, today’s viruses/worms can propagate attacks. In this paper, we propose generating vulnerability-based quickly and infect most of the vulnerable machines on signatures on the network level without any host-level analysis the Internet within ten minutes [11] or even less than 30 of worm execution or vulnerable programs. As the first step, seconds with some highly virulent techniques [12], [13] we design a network-based Length-based Signature Generator at near-exponential propagation speed. At the early stage 1 (LESG) for worms based on buffer overflow vulnerabilities . The signatures generated are intrinsic to buffer overflows, and of w