Recent Advances in Intrusion Detection

Volume 4219 of the series Lecture Notes in Computer Science pp 61-80

Allergy Attack Against Automatic Signature Generation

  • Simon P. ChungAffiliated withDepartment of Computer Sciences, University of Texas at Austin
  • , Aloysius K. MokAffiliated withDepartment of Computer Sciences, University of Texas at Austin


Research in systems that automatically generate signatures to filter out zero-day worm instances at perimeter defense has received a lot of attention recently. While a well known problem with these systems is that the signatures generated are usually not very useful against polymorphic worms, we shall in this paper investigate a different, and potentially more serious problem facing automatic signature generation systems: attacks that manipulate the signature generation system and turn it into an active agent for DoS attack against the protected system. We call this new attack the “allergy attack”. This type of attack should be anticipated and has in fact been an issue in the context of “detraining” in machine learning. However, we have not seen a demonstration of its practical impact in real intrusion detection/prevention systems. In this paper, we shall demonstrate the practical impact of “allergy attacks”.


Automatic Signature Generation Adaptive Response Intrusion Prevention