Electronics and Telecommunications Research Institute

Sung Won Yi

Jin Tae Oh

Hwa Shin Moon

Young Chan Shin

Provided is a method and apparatus for generating a network attack signature capable of generating a signature having a high reliability while minimizing a whitelist used to prevent false positive. An application header and application data are separated from each other to measure byte distributions of the application header and the application data from an input packet. When an attack signature is generated by analyzing the measured byte distributions, a substring of the application data is used to generate the attack signature, and a substring of the application header is used as supporting information on the signature.

Method and apparatus for generating network attack signature

An apparatus and method for extracting signature candidates and optimizing a corresponding signature are provided. The apparatus includes a packet separator, a header parser, a traffic information generator, a substring extractor, and a signature candidate extractor. The packet separator separates a packet into a header and a payload. The header information parser parses the header information, and the traffic information generator generates traffic information. The substring extractor measures a frequency of appearing of a substring with a predetermined length in the separated payload for a constant observation period, and extracts a substring having a frequency higher than a predetermined setup value by updating the measured frequency information to a substring frequency table. The signature candidate extractor generates a signature by collecting the extracted substring information and the generated traffic information, updates a signature frequency table, and extracts a signature candidate with reference to information of the signature frequency table.

Growing community of inventors

Seoul, South Korea

Sung Won Yi