A rough set approach for automatic key attributes identification of zero-day polymorphic worms

NCU Institutional Repository > 管理學院 > 資訊管理研究所 > 期刊論文 > Item 987654321/29647

請使用永久網址來引用或連結此文件: http://ir.lib.ncu.edu.tw/handle/987654321/29647

題名:	A rough set approach for automatic key attributes identification of zero-day polymorphic worms
作者:	Sun,WC;Chen,YM
貢獻者:	資訊管理研究所
關鍵詞:	KNOWLEDGE
日期:	2009
上傳時間:	2010-06-29 20:37:17 (UTC+8)
出版者:	中央大學
摘要:	In recent years, given their rapid propagations, Internet worms increasingly threaten the Internet hosts and services. It's worsen by the fact that zero-day polymorphic worms, which can change their patterns dynamically, would evade most existing intrusion detection systems which depend on some signature generating approach. In this paper, we propose a novel rough set worm detection (RSWD) scheme which extends well developed rough set theory (RST) to detect zero-day polymorphic worms and provide a minimum set of filtering rules to network barrier equipments, such as firewall, to block worm spreading. The RSWD scheme is based on an assumption that, for a polymorphic worm, all attack packets are generated from some specific worm program and attack the same vulnerability of the victim hosts, therefore some patterns exist even the polymorphic engine mutates dynamically and frequently. Our simulations show that, in a class B network containing a new polymorphic worm which can not be recognized by any known signature, the RSWD module could detect the worm propagation within 17 s and produce a precise blocking rule exhibiting 100% true positive rate and 99.82% accuracy rate. (C) 2008 Elsevier Ltd. All rights reserved.
關聯:	EXPERT SYSTEMS WITH APPLICATIONS
顯示於類別:	[資訊管理研究所] 期刊論文

文件中的檔案:

檔案	描述	大小	格式	瀏覽次數
index.html		0Kb	HTML	719	檢視/開啟

在NCUIR中所有的資料項目都受到原著作權保護.

社群 sharing

資料載入中.....