Automated Worm Fingerprinting

This paper is very much like another EarlyBird paper posted here recently:

Network worms are a clear and growing threat to the security of today's Internet-connected hosts and networks. The combination of the Internet's unrestricted connectivity and widespread software homogeneity allows network pathogens to exploit tremendous parallelism in their propagation. In fact, modern worms can spread so quickly, and so widely, that no human-mediated reaction can hope to contain an outbreak.

In this paper, we propose an automated approach for quickly detecting previously unknown worms and viruses based on two key behavioral characteristics-a common exploit sequence together with a range of unique sources generating infections and destinations being targeted. More importantly, our approach-called "content sifting"-automatically generates precise signatures that can then be used to filter or moderate the spread of the worm elsewhere in the network.

Using a combination of existing and novel algorithms we have developed a scalable content sifting implementation with low memory and CPU requirements. Over months of active use at UCSD, our Earlybird prototype system has automatically detected and generated signatures for all pathogens known to be active on our network as well as for several new worms and viruses which were unknown at the time our system identified them. Our initial experience suggests that, for a wide range of network pathogens, it may be practical to construct fully automated defenses-even against so-called "zero-day" epidemics.

Source: Automated Worm Fingerprinting, Sumeet Singh, Cristian Estan, George Varghese, and Stefan Savage, appeared at OSDI 2004.

Quickly scanning this paper reveals some interesting algorithms and approaches. I'm concerned a bit about the algorithm described in Figure 1, however. It uses simple thresholds to detect the presence of multiple targets. However, this seems like it would be indistinguishable from P2P traffic, for example, or any sort of related activity which sees increasing interest. Some initial analysis must be done on the payloads prior to analyzing them in this fashion or a high number of false positives are likely to be thrown for P2P requests. Furthermore, it seems important to periodically flush out the list of buffers, providing a sliding window of observations. Over time, these thresholds will be hit as observations accumulate. And finally, it's important to keep a baseline of observations of payloads to avoid detecting normal traffic changes as new worms.

Otherwise this is a worthwhile paper and it seems to have proven itself in field testing.