An Integrated Approach to Worm Detection and Automatic Signature Generation

Modern worms spread so quickly on the Internet that traditional methods which entail human labor to generate signatures might not be fast enough to contain their spreading. It´ s necessary to automate the processes of both worm detection and signature generation. In this paper, we firstly propose a detection algorithm with an evidence fusion model integrating four anomalous network behaviors. When malicious traffic has been found, a hierarchical cluster based signature generation algorithm is applied to analyze the content of worm flows and generate signatures automatically. The experiment shows that our approach is noise-tolerant and be able to detect worm attacks in time and generate signatures quickly and accurately.