Digital Image Processing

N. Kannaiya Raja ¹, K. Arulanandam ², G. Deepa ¹, M. Balaji ³

Affiliations
1 CSE Department, Arulmigu Meenakshi Amman College of Engineering, Thiruvannamalai Dt, Near Kanchipuram, IN
2 CSE Department, Ganadipathy Tulsi’s Jain Engineering College, Vellore, IN
3 Arulmigu Meenakshi Amman College of Engineering, Thiruvannamalai Dt, Near Kanchipuram, IN

Abstract

One way to protect organizations from malware is to deploy high-speed network based intrusion detection systems on the communication lines. This approach is achieved by P-DPL. Such appliances perform deep-packet inspection in real- time and use simple signatures for detecting and removing attacks such as malware, propagating worms, denial-of-service, or remote exploitation of vulnerabilities. P-DPL is primarily intended for high-speed network traffic filtering devices that are based on deep-packet inspection. Malicious executables are analyzed using two approaches: disassembly, utilizing IDA-Pro, and the application of a dedicated state machine in order to obtain the set of functions comprising the executables. The signature extraction process is based on a comparison with a common function repository. By eliminating functions appearing in the common function repository from the signature candidate list, P-DPL can minimize the risk of false-positive detection errors. To minimize false-positive rates even further, P-DPL proposes intelligent candidate selection using an entropy score to generate signatures.

Keywords

Automatic Signature Generation (ASG), Malware, Malware Filtering, Packet-Deployment Payload (P-DPL).

Full Text