To prevent worms from propagating rapidly, it is essential to generate worm signatures quickly and accurately. However, existing methods for generating worm signatures either cannot handle noise well or assume there is only one kind of worm sequence in the suspicious flow pool. We propose an approach based on seed extending signature generation SESG to generate polymorphic worm signatures from a suspicious flow pool which includes several kinds of worm and noise sequences. The proposed SESG algorithm computes the weight of every sequence, the sequences are queued based on their weight, and then classified. Worm signatures are then generated from the classified worm sequences. We compare SESG with other approaches. SESG can classify worm and noise sequences from a suspicious flow pool, and generate effective worm signatures more easily.
['Jie Wang', 'Xiaoxian He']
A Signature Generation Approach Based on Clustering for Polymorphic Worm