Survey of automatic attack signature generation
Yongjun Wang · Journal of Communications · 2009
Automatic signature generation,an emerging technique in network security,can be used to automatically de-tect new attacks(e.g.,new worms) and generate their signatures for detection.The research motivation and the evaluation criterions of automatic signature generation were presented.The proposed automatic signature generation approaches were classified into two types:NSG(network-based signature generation) and HSG(host-based signature generation):HSG systems were deployed in protecting hosts and made use of host information,NSG systems were deployed in net-work and solely analyzed the suspicious network traffic to generate signatures for new attacks.Typical HSG and NSG systems were respectively introduced and compared.Finally,the problems of current research and the future directions were discussed.