Re: A Neural Network to detect polymorphic shellcodes

Hi,

> A simpler strategy is to look for distinguishing features of the mutator.
> I wrote such a preprocessor to detect mutated NOP sleds for snort a
> while back. Search for "spp_fnord.c" in bugtraq archives and you
> should find it.


I know the preprocessor. the probleme is its false posetive rate. I have not 
teted it but I read a lot about it.

I geuss the false posetive rate could be decreased if the fix threshould of 
the NOP sled to a higher value. I am not sure but I remember thatr I read 
that linux shellcode have generally a big NOP zone (grater than 100 
bytes)...is this true? (I focus on detecting Linux polymorphic worms)

_________________________________________________________________
MSN Messenger: appels gratuits de PC à PC ! 
http://www.msn.fr/newhotmail/Default.asp?Ath=f


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------