Internet Worm Defenses

From Computing and Software Wiki

Revision as of 22:08, 6 April 2008 by Muslehj (Talk)
Jump to: navigation, search

Worms are considered a serious threat against information integrity and service availability. Internet worms have repeatedly exposed and exploited the vulnerabilities of network hosts and the underlying internet architecture. Understanding the principles and patterns of worm propogation is crucial to developing counter measures. Models have been develped to analyse network traffic and the effectiveness of various worm defense mechanisms. This information can be used to select an appropriate defense strategy for worms of different nature.

Contents

Passive Defense

Passive defense strategies, also known as containment technologies aim at slowing down and eventually stopping the spread of a worm. The basic idea is to block all infectious communication between infected hosts and other susceptible hosts. Packets containing a signature that is known to belong to a particular warm can be dropped.For these strategies to be effective, early detection of a worm epidemic is crucial.

Firewalls, content filters and address blacklisting are all examples of such containment technologies. There is a large number of software products that implement some of those strategies. Content filtering requires analysis of every single packets, which is a real overhead. Moreover, aggressive worms that generate random permutations of content may be able to surpass packet filters. As for address blacklisting, it can be implemented in routers. There are issues with identifying infected hosts and distributing blacklists. Simulations experiments have shown that content filtering works better than address blacklisting. In fact, it can contain worms an order of magnitude more aggressive.

Those measures alone are not sufficient to counter the worm threat, since infected hosts are not recovered. However, they can be used until a security patch is available. In reality it is extremely challenging to build containment systems of large scope. Designing systems that are able to automatically detect worm epidemics and to activate filtering mechanisms within a reasonable time frame is not an easy task.

Active Defense

aaa

Empty Defense

Simple Patch

Spreading Patch

Nullifying Defense

Sniper Defense

References

1. Models of Active Worm Defenses

2. Defense and Detection Strategies against Internet Worms, Jose Nazario

3. An Improved Worm Mitigation Model for Evaluating the Spread of Aggressive Network Worms

4. The Effect of Infection Time on Internet Worm Propagation

See also

Exteral links

Comparing Passive and Active Worm Defenses

A Network Worm Modeling Package

Internet Worm Propagation Simulators

Worm Blog

Personal tools