Automatic generating regular expression signatures for real network worms

Abstract

A practical worm regular expression of automatic extraction method was presented,which involves four steps:sample collection from worm propagation, signature tre generation, removal of high false-positive signatures, and sig-nature merging. The advantage of this method is that it can directly output expression signature with the rich syntax of“.*”, “.{k}”, “|”, “(c){k}”. Based on the honeypot system Honeybow deployed in Internet, the method was implemented and evaluated by several in-wild worms under real Internet environment. The experiment results show that the method can generate accurate regular expression signatures for real worms and is promising for the applications of automatic analysis of worms and malwares.

Keywords

• worm
• malware
• signature generation
• signature tree
• regular expression
• honeybow
• intrusion detection