Automatic defense against zero-day polymorphic worms in communication networks

 Content: The Fundamental Concepts  Introduction    Network Security Concepts    Automated Signature Generation for Zero-Day Polymorphic Worms  Our Experience and This Book\'s Objective  References   Computer Networking  Computer Technologies  Network Topology    Point-to-Point Topology    Daisy-Chain Topology    Bus (Point-to-Multipoint) Topology    Distributed Bus Topology    Ring Topology   Dual-Ring Topology    Star Topology    Star-Wired Bus Topology    Star-Wired Ring Topology   Mesh Topology    Hierarchical or Tree Topology    Dual-Homing Topology Internet Protocol  Transmission Control Protocol IP Routers Ethernet Switch IP Routing and Routing Table  Discussion on Router    Access Mechanisms for Administrators   Security Policy for a Router    Router Security Policy Checklist Network Traffic Filtering   Packet Filtering    Source Routing Tools Used for Traffic Filtering or Network Monitoring   Packet Capture  Concluding Remarks References   Intrusion Detection and Prevention Systems (ID PSs)  Introduction  IDPS Detection Methods    Signature-Based Detection    Anomaly-Based Detection    Stateful Protocol Analysis  IDPS Components  IDPS Security Capabilities  Types of IDPS Technologies    Network-Based IDPSs    Wireless IDPSs    NBA Systems    Host-Based IDPS  Integration of Multiple IDPSs    Multiple IDPS Technologies    Integration of Different IDPS Products  IDPS Products   Common Enterprise Network-Based IDPSs    Common Enterprise Wireless IDPSs    Common Enterprise NBA Systems   Common Enterprise Host-Based IDPSs  Concluding Remarks  References   Honeypots  Definition and History of Honeypots    Honeypot and Its Working Principle    History of Honeypots    Types of Honeypots Types of Threats    Script Kiddies and Advanced Blackhat Attacks    Attackers\' Motivations  The Value of Honeypots    Advantages of Honeypots    Disadvantages of Honeypots    Roles of Honeypots in Network Security  Honeypot Types Based on Interaction Level   Low-Interaction Honeypots   High-Interaction Honeypots   Medium-Interaction Honeypots  An Overview of Five Honeypots    BackOfficer Friendly    Specter    Honeyd    ManTrap    Honeynets  Conclusion References   Internet Worms  Introduction  Infection    Code Injection    Edge Injection    Data Injection  Spreading  Hiding    Traffic Shaping    Polymorphism    Fingerprinting  Worm Components    Reconnaissance    Attack Components    Communication Components   Command Components    Intelligence Capabilities  Worm Life    Random Scanning    Random Scanning Using Lists   Island Hopping    Directed Attacking    Hit-List Scanning  Polymorphic Worms: Definition and Anatomy    Polymorphic Worm Definition   Polymorphic Worm Structure   Invariant Bytes   Polymorphic Worm Techniques    Signature Classes for Polymorphic Worms  Internet Worm Prevention Methods    Prevention of Vulnerabilities    Prevention of Exploits  Conclusion  References   Reading Resources on Automated Signature Generation Systems  Introduction   Hybrid System (Network Based and Host Based)    Network-Based Mechanisms    Host-Based Mechanisms References   Signature Generation Algorithms for Polymorphic Worms  String Matching    Exact String-Matching Algorithms   Approximate String-Matching Algorithms  Machine Learning    Supervised Learning   Algorithm Selection    Logic-Based Algorithms   Learning Set of Rules    Statistical Learning Algorithms   Support Vector Machines Unsupervised Learning   A Brief Introduction to Unsupervised Learning    Dimensionality Reduction and Clustering Models   Expectation-Maximization Algorithm    Modeling Time Series and Other Structured Data   Nonlinear, Factorial, and Hierarchical Models   Intractability    Graphical Models    Exact Inference in Graphs    Learning in Graphical Models   Bayesian Model Comparison and Occam\'s Razor  Concluding Remark  References   Zero-Day Polymorphic Worm Collection Method  Introduction  Motivation for the Double-Honeynet System  Double-Honeynet Architecture  Software    Honeywall Roo CD-ROM    Sebek    Snort_inline  Double-Honeynet System Configurations    Implementation of Double-Honeynet Architecture  Double-Honeynet Configurations  Chapter Summary  References   Developed Signature Generation Algorithms  Introduction  An Overview and Motivation for Using String Matching  The Knuth-Morris-Pratt Algorithm    Proposed Substring Extraction Algorithm    A Modified Knuth-Morris-Pratt Algorithm    Testing the Quality of the Generated Signature for Polymorphic Worm A  Modified Principal Component Analysis    An Overview of and Motivation for Using PCA in Our Work    Our Contributions in the PCA    Determination of Frequency Counts    Using PCA to Determine the Most Significant Data for Polymorphic Worm Instances   Testing the Quality of the Generated Signature for Polymorphic Worm A  Clustering Method for Different Types of Polymorphic Worms  Signature Generation Algorithm Pseudocodes    Signature Generation Process    Testing the Quality of the Generated Signature for Polymorphic Worm A  Chapter Summary Conclusion and Recommendations for Future Work  References