An Automated Signature Generation Approach for Polymorphic Worms Using Factor Analysis
Internet worms pose a major threat to Internet infrastructure security, and their destruction will be truly costly. Therefore, the networks must be protected as much as possible against such attacks. In this paper we propose automatic and accurate system for signature generation for unknown polymorphic worms. We have designed a novel double honeynet system, which is able to detect new worms that have not been seen before. We apply Factor Analysis to determine the most significant substrings that are shared among polymorphic worm instances and use them as signatures. The system is able to generate accurate signatures for polymorphic worms.