Computer Science – Cryptography and Security
Scientific paper
2005-04-12
Journal of Computer Security, Vol 15, Number 3, 303-320, 2007
Computer Science
Cryptography and Security
12 pages, LaTeX, two columns
Scientific paper
Internet worms have become a widespread threat to system and network operations. In order to fight them more efficiently, it is necessary to analyze newly discovered worms and attack patterns. This paper shows how techniques based on Kolmogorov Complexity can help in the analysis of internet worms and network traffic. Using compression, different species of worms can be clustered by type. This allows us to determine whether an unknown worm binary could in fact be a later version of an existing worm in an extremely simple, automated, manner. This may become a useful tool in the initial analysis of malicious binaries. Furthermore, compression can also be useful to distinguish different types of network traffic and can thus help to detect traffic anomalies: Certain anomalies may be detected by looking at the compressibility of a network session alone. We furthermore show how to use compression to detect malicious network sessions that are very similar to known intrusion attempts. This technique could become a useful tool to detect new variations of an attack and thus help to prevent IDS evasion. We provide two new plugins for Snort which demonstrate both approaches.
No associations
LandOfFree
Analyzing Worms and Network Traffic using Compression does not yet have a rating. At this time, there are no reviews or comments for this scientific paper.
If you have personal experience with Analyzing Worms and Network Traffic using Compression, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Analyzing Worms and Network Traffic using Compression will most certainly appreciate the feedback.
Profile ID: LFWR-SCP-O-350233