Zero-Day Signature Extraction for High-Volume Attacks

We present a basic tool for zero day attack signature extraction. Given two large sets of messages, $P$ the messages captured in the network at peacetime (i.e., mostly legitimate traffic) and $A$ the messages captured during attack time (i.e., contains many attack messages), we present a tool for extracting a set $S$ of strings that are frequently found in $A$ and not in $P$ , thus allowing the identification of the attack packets. This is an important tool in protecting sites on the Internet from worm attacks and distributed denial of service attacks and may also be useful for other problems, including command and control identification and the DNA-sequences analysis. The main contributions of this paper are the system we developed to extract the required signatures together with the string-heavy hitters problem definition and the algorithm for solving this problem. This algorithm finds popular strings of variable length in a set of messages, using, in a tricky way, the classic heavy-hitter algorithm as a building block. The algorithm runs in linear time requiring one-pass over the input. Our system makes use of this algorithm to extract the desired signatures. Furthermore, we provide an extended algorithm which is able to identify groups of signatures, often found together in the same packets, which further improves the quality of signatures generated by our system. Using our system, a yet unknown attack can be detected and stopped within minutes from attack start time.