The Automatic Signature Extraction feature is used to identify and define potential worms and viruses found in network traffic based on the following characteristics:

• Content invariance identifies that all worms have some code that remains unchanged through the infection.

• Content prevalence identifies if packet payloads were observed frequently in the network. Because worms are designed to spread, the unchanged portion of a worm’s content appears frequently on a network as it spreads or attempts to spread.

• Address dispersion identifies whether the same payload is sent to and from a large number of source and destination IP address pairs.

Note	The ASE feature can detect e-mail viruses but is disabled by default. This feature can be enabled on the ASE collector. Contact your Cisco representative for more information.

When the ASE sensor extracts a malware signature, the ASE sensor sends the signature to the collector using the TIDP Threat Mitigation Service (TMS) to contain and mitigate the malware outbreak among TMS consumers spread across the network. The TMS framework rapidly and efficiently distributes threat information to devices on the network and generates actions to TMS consumers to either drop or redirect the packets containing the malware signature.

Note	See the "Automatic Signature Extraction Sensor Operation" for more information on this feature.

The ASE feature has two main components: a sensor and collector. The ASE sensor sifts through the contents of network traffic to reduce the number of different source and destination addresses seen in packets. To minimize the impact on the device, sensing can be enabled or disabled on a per-interface basis and traffic designated as ASE traffic can be specified. The ASE sensor observes the same traffic as the router can observe after an access list is applied.

Note	The sensor is unable to extract signatures from within encrypted traffic passing through a router.

The figure below shows that devices A and C are infected with the same worm. As traffic crosses the Cisco IOS router running the ASE sensor, the router extracts the worm’s signature based on its address dispersion and content prevalence. Then the router sends this information to the ASE collector for further processing.

The ASE collector, which runs on a Linux-based PC, performs the following functions:

• Processes signatures it receives from the ASE sensor.

• Initiates the mitigation of signatures.

• Coordinates detection between multiple ASE sensors.

• Manages and distributes entry information and files on the network.

• Collects signatures and packets sent by the sensor.

• Analyzes extracted signatures to determine what the best signature is for a malicious packet to correctly identify a threat.

• Performs post processing of signatures to reduce false alarms.

• Maintains a signature database.

• Reduces false positives in signatures through classification.

• Manages sensor configuration such as thresholds, scanning criteria, and other parameters.

• Generates a report or reports on collected signatures.

Note	Contact your Cisco representative for more information about installing the ASE collector functionality on your network.

Self-propagating worms continue to grow and affect the security of hosts and networks. These malicious malware attacks often target specific victims or subnets within an enterprise organization. Specifically, a worm can affect and saturate the local network (including all hosts), the branch router, and the local WAN connection or both. The optimal location to detect, contain, and mitigate these worms is on the gateway network connection to prevent the worms from spreading to the entire network, including all connected branches.