We present a basic tool for zero day attack signature extraction. Given two large sets of messages, P the messages captured in the network at peacetime (i.e., mostly legitimate traffic) and A the messages captured during attack time (i.e., contains many attack messages), we present a tool for extracting a set S of strings that are frequently found in A and not in P, thus allowing the identification of the attack packets. This is an important tool in protecting sites on the Internet from worm attacks and distributed denial of service attacks and may also be useful for other problems, including command and control identification and the DNA-sequences analysis. The main contributions of this paper are the system we developed to extract the required signatures together with the string-heavy hitters problem definition and the algorithm for solving this problem. This algorithm finds popular strings of variable length in a set of messages, using, in a tricky way, the classic heavy-hitter algorithm as a building block. The algorithm runs in linear time requiring one-pass over the input. Our system makes use of this algorithm to extract the desired signatures. Furthermore, we provide an extended algorithm which is able to identify groups of signatures, often found together in the same packets, which further improves the quality of signatures generated by our system. Using our system, a yet unknown attack can be detected and stopped within minutes from attack start time.
Bibliographical noteFunding Information:
This work was supported in part by The Blavatnik Interdisciplinary Cyber Research Center, Tel Aviv University, in part by the European Research Council (ERC) under Grant 259085, in part by the Ministry of Science and Technology, Israel, and in part by the Kabarnit-Cyber Consortium (2012-2014) under Magnet Program through the Israeli Ministry of Industry, Trade and Labor. The authors thank Z. Gadot from Red Button, and M. Atad and S. Shitrit from Radware Ltd., for helpful discussions. They also thank G. Parashi for his help with code implementation.
Manuscript received December 6, 2016; revised April 29, 2018; accepted January 13, 2019; approved by IEEE/ACM TRANSACTIONS ON NETWORK-ING Editor W. Wang. Date of publication March 6, 2019; date of current version April 16, 2019. This work was supported in part by The Blavatnik Interdisciplinary Cyber Research Center, Tel Aviv University, in part by the European Research Council (ERC) under Grant 259085, in part by the Ministry of Science and Technology, Israel, and in part by the Kabarnit-Cyber Consortium (2012–2014) under Magnet Program through the Israeli Ministry of Industry, Trade and Labor. (Corresponding author: Shir Landau Feibish.) Y. Afek is with the Blavatnik School of Computer Science, Tel Aviv University, Tel Aviv 6997801, Israel.
© 2019 IEEE.
- heavy hitters
- High volume attacks
- signature extraction
- zero-day attacks