Worm Signature Generation for Network Propagation Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network management systems face challenges in efficiently detecting and mitigating worm propagation, particularly in enterprise networks, which leads to increased costs and complexity in maintaining network security and performance.
Innovation Solution
A computer program product and method that identifies recurring sets of bits in network traffic, determines propagation and connectedness, and generates worm signatures to automatically detect and mitigate email-based and exploit-based worms by consolidating signatures and distributing them to security devices for filtering out potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If manual signature creation and distribution is used, then security devices can filter worms, but the time between worm identification and mitigation is excessive
Solution Approach 1:
The system performs preliminary actions by automatically generating worm signatures and distributing them to security devices immediately upon detecting worm propagation patterns. This eliminates manual intervention delays by pre-computing signatures and pushing them out through the distribution mechanism before the worm can spread extensively.
Solution Approach 2:
The system enables self-service by allowing security devices to automatically receive and implement worm signatures without human intervention. The automated distribution mechanism delivers signatures directly to firewalls and other security devices, which then autonomously apply the filtering rules to block worm traffic.
2Reliability
If comprehensive network monitoring is implemented to detect worms, then worm propagation can be detected, but the complexity and cost of network management increases
Solution Approach 1:
The system applies universality by creating a multi-functional automated response mechanism that handles multiple worm types and propagation methods through a single unified system. The signature generation and distribution infrastructure serves various security devices and multiple worm detection scenarios, reducing the need for separate specialized tools for each threat.
Solution Approach 2:
The system introduces an intermediary automated signature generation and distribution mechanism that bridges the gap between worm detection and security device implementation. This intermediary layer translates detected worm patterns into actionable signatures and distributes them automatically, simplifying the overall network management complexity while maintaining reliable detection.
3Object-affected harmful factors
If worm traffic is blocked aggressively, then worm spread is prevented, but innocuous traffic may be incorrectly filtered
Solution Approach 1:
The system applies local quality by creating highly specific worm signatures that target only the harmful worm traffic patterns while leaving legitimate traffic unaffected. Each signature is crafted to match precise worm characteristics (such as specific byte sequences or propagation patterns), ensuring that only the targeted worm variants are blocked while innocuous traffic with different characteristics passes through unchanged.
Data Source
AI summary
A system, method and computer program product for exploit-based worm detection and mitigation are disclosed. The system, method, and computer program product are configured to identify a signature representing content prevalent in network traffic, determine if the traffic including the signature exhibits propagation, determine if the traffic including the signature exhibits connectedness, and generate a worm signature based on the signature if the signature exhibits both connectedness and propagation.