A Fast Positive Approach of P-DPL in the Packet Inspection

Abstract

One way to protect organizations from malware is to deploy high-speed network based intrusion detection systems on the communication lines. This approach is achieved by P-DPL. Such appliances perform deep-packet inspection in real- time and use simple signatures for detecting and removing attacks such as malware, propagating worms, denial-of-service, or remote exploitation of vulnerabilities. P-DPL is primarily intended for high- speed network traffic filtering devices that are based on deep-packet inspection. Malicious executables are analyzed using two approaches: disassembly, utilizing IDA-Pro, and the application of a dedicated state machine in order to obtain the set of functions comprising the executables. The signature extraction process is based on a comparison with a common function repository. By eliminating functions appearing in the common function repository from the signature candidate list, P-DPL can minimize the risk of false-positive detection errors. To minimize false-positive rates even further, P-DPL proposes intelligent candidate selection using an entropy score to generate signatures.