Polymorphic worm detection by analyzing maximum length of instruction sequence in network packets

Kohei Tatara, Yoshiaki Hori, Kouichi Sakurai

研究成果: Chapter in Book/Report/Conference proceedingConference contribution

抄録

Intrusion detection system records worm's signature, and detects the attack that lurks in traffic based on it. However, to detect the worm that corrects, and changes some oneself, a highly accurate detection technique for distinguishing the code that seems to be the worm included in traffic is requested. In this paper, we pay attention to the Toth et al.'s method to extract the executable code included in the data flows on the network and detect the attack by measuring the length of them. Then, we describe the problem of their method and how to solve it.

本文言語英語
ホスト出版物のタイトルProceedings - International Conference on Availability, Reliability and Security, ARES 2009
ページ972-977
ページ数6
DOI
出版ステータス出版済み - 10 12 2009
イベントInternational Conference on Availability, Reliability and Security, ARES 2009 - Fukuoka, Fukuoka Prefecture, 日本
継続期間: 3 16 20093 19 2009

出版物シリーズ

名前Proceedings - International Conference on Availability, Reliability and Security, ARES 2009

その他

その他International Conference on Availability, Reliability and Security, ARES 2009
Country日本
CityFukuoka, Fukuoka Prefecture
Period3/16/093/19/09

All Science Journal Classification (ASJC) codes

  • Software
  • Safety, Risk, Reliability and Quality

フィンガープリント 「Polymorphic worm detection by analyzing maximum length of instruction sequence in network packets」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル