Worm propagation mitigation
View Patent ↗A system, method, and computer program product for identifying a worm are disclosed. The system, method, and computer product are configured to generate a signature for a computer worm by identifying a set of bits representing the signature, generate a first worm signature based on the signature, and generate a second worm signature based on the signature. The first worm signature is formatted for a first device and the second worm signature is formatted for a second, different device. The first worm signature and the second worm signature are different.
1. A computer program product residing on a non-transitory computer readable storage medium for intrusion detection in a network, the computer program product comprising instructions for causing a processor to:
generate an initial signature for a computer worm by identifying a set of bits representing the computer worm;
determine if devices in the network are capable of filtering traffic using the generated initial signature;
in response to determining that the devices in the network are not capable of filtering traffic using the generated initial signature, discard the generated initial signature; and
in response to determining that the devices in the network are capable of filtering traffic using the generated initial signature,
generate a first worm signature based on the generated initial signature, the first worm signature formatted for a first device; and
generate a second worm signature based on the generated initial signature, the second worm signature formatted for a second, different device, with the first worm signature and the second worm signature being different.
2. The computer program product of claim 1 further comprising instructions for causing a processor to:
communicate the first worm signature to the first device; and
communicate the second worm signature to the second device.
3. The computer program product of claim 1 further comprising instructions for causing a processor to log the identified set of bits in a database.
4. The computer program product of claim 1 wherein the first device is a device selected from the group consisting of a host based security device, an intrusion protection system, a firewall, a switch, and a router.
5. The computer program product of claim 1 wherein the second device is a device selected from the group consisting of a host based security device, an intrusion protection system, a firewall, a switch, and a router.
6. The computer program product of claim 1 wherein the instructions to generate the first worm signature and the instructions to generate the second worm signature comprise instructions to automatically generate the first and second worm signatures.
7. The computer program product of claim 1 wherein the instructions to generate the first worm signature and the instructions to generate the second worm signature comprise instructions to generate the first and second worm signatures without human intervention.
8. The computer program product of claim 1 wherein the first and second worm signatures comprise a set of instructions for causing the first and second device to mitigate worm propagation.
9. The computer program product of claim 1 wherein the instructions to identify the set of bits representing the signature for the computer worm comprise instructions to:
receive packet payload data; and
analyze the packet payload data to identify recurring sets of bits.
10. An intrusion detection system in a network, comprising:
a system configured to:
analyze packet payloads, by a computer processor, to generate an initial signature for a computer worm by identifying a set of bits representing the computer worm;
determine if devices in the network are capable of filtering traffic using the generated initial signature;
in response to determining that the devices in the network are not capable of filtering traffic using the generated initial signature, discard the generated initial signature; and
in response to determining that the devices in the network are capable of filtering traffic using the generated initial signature,
generate a first worm signature based on the generated initial signature, the first worm signature being formatted for a first device; and
generate a second worm signature based on the generated initial signature, the second worm signature being formatted for a second, different device, with the first worm signature and the second worm signature being different.
11. The intrusion detection system of claim 10 , wherein the system is further configured to:
communicate the first worm signature to the first device; and
communicate the second worm signature to the second device.
12. The intrusion detection system of claim 10 , further comprising:
a database; and
a processor configured to log the identified set of bits in a database.
13. The intrusion detection system of claim 10 wherein at least one of the first device and the second device comprises a device selected from the group consisting of a host based security device, an intrusion protection system, a firewall, a switch, and a router.
14. A method for intrusion detection in a network comprising:
generating, by a computer processor, an initial signature for a computer worm by identifying a set of bits representing the computer worm;
determining if devices in the network are capable of filtering traffic using the generated initial signature;
in response to determining that the devices in the network are not capable of filtering traffic using the generated initial signature, discarding the generated initial signature; and
in response to determining that the devices in the network are capable of filtering traffic using the generated initial signature,
generating a first worm signature based on the generated initial signature, the first worm signature being formatted for a first device; and
generating a second worm signature based on the generated initial signature, the second worm signature being formatted for a second, different device, with the first worm signature and the second worm signature being different.
15. The method of claim 14 further comprising:
communicating the first worm signature to the first device; and
communicating the second worm signature to the second device.
16. The method of claim 14 further comprising logging the identified set of bits in a database.
17. The method of claim 14 wherein at least one of the first device and the second device comprises a device selected from the group consisting of a host based security device, an intrusion protection system, a firewall, a switch, and a router.
18. The method of claim 14 wherein the first and second worm signatures comprise a set of instructions for causing the first and second device to mitigate worm propagation.
19. The method of claim 14 further comprising:
receiving packet payload data; and
analyzing the packet payload data to identify recurring sets of bits.