Automatic generation of trojan signatures for intrusion detection

A non-transitory computer-readable medium storing instructions which, when executed by a processing system including at least one processor, cause the processing system to perform operations, the operations comprising:

• extracting a plurality of request packets from a plurality of hypertext transfer protocol session packets associated with a plurality of known trojans, wherein all trojans in the plurality of known trojans are identified by a common signature identifier;
• identifying a plurality of suspicious request packets within the plurality of request packets that is extracted from the plurality of hypertext transfer protocol session packets;
• grouping the plurality of suspicious request packets into at least one subset;
• computing a centroid of the at least one subset;
• identifying a representative packet for the at least one subset, wherein the representative packet is identified based on the centroid;
• and
• generating a signature for the at least one subset, based on the representative packet, wherein the signature is deployable by an intrusion detection system to detect an instance of a trojan of the plurality of known trojans.

A system comprising:

• a processing system including at least one processor;
• and
• a non-transitory computer-readable medium storing instructions which, when executed by the processing system, cause the processing system to perform operations, the operations comprising:
• extracting a plurality of request packets from a plurality of hypertext transfer protocol session packets associated with a plurality of known trojans, wherein all trojans in the plurality of known trojans are identified by a common signature identifier;
• identifying a plurality of suspicious request packets within the plurality of request packets that is extracted from the plurality of hypertext transfer protocol session packets;
• grouping the plurality of suspicious request packets into at least one subset;
• computing a centroid of the at least one subset;
• identifying a representative packet for the at least one subset, wherein the representative packet is identified based on the centroid;
• and
• generating a signature for the at least one subset, based on the representative packet, wherein the signature is deployable by an intrusion detection system to detect an instance of a trojan of the plurality of known trojans.