Novel approach based on neighborhood relation signature against polymorphic internet worms

Abstract

A class of neighborhood-relation signatures（NRS） was proposed based on neighborhood relationship between worm bytes.Because NRS embodies common characteristics of different morph of some polymorphic worms,Different patterns of polymorphic worms efficiently were detected.NRS generating algorithm（NRSGA） was designed to generate three types of signatures: 1-NRS,2-NRS and（1,2）-NRS.Some experiments were performed to demonstrate the correct-ness of the process of signatures generation and the effectiveness of NRS.Experiment results show that our approach has lower false negative ratio in detecting worms,and is effective to prevent polymorphic worms from propagating.

Keywords

• information security
• worm signature
• NRS
• polymorphic worm
• worm detection