The importance of the method for finding out the worms that are made through the modification of parts of their original worms increases. It is difficult to detect these worms by comparing with the simple definition that past anti-virus software adapts. Moreover, if it is not an already-known worm, it is not possible to detect it. In this research, we pay attention to the Toth et al.'s method to extract the executable code included in the data flows on the network and detect the attack by measuring the length of them. Then, we describe the problem of their method and how to solve it.
Papers
- Kohei Tatara, Yoshiaki Hori, Kouichi Sakurai, Analyzing Maximum Length of Instruction Sequence in Network Packets for Polymorphic Worm Detection, Proceedings of The 2nd International Conference on Multimedia and Ubiquitous Engineering (MUE2008), pp. 485-489, IEEE Computer Society, April 2008.