Effectiveness of Rate Control in Slowing Down Worm Epidemics
Nasir Jamil, Tom Chen · 2006
Rate control is an automated defense to slow down a worm outbreak to buy time for conventional defenses to take effect. In this study, we apply the community of households model from biological epidemiology to evaluate rate control strategies. We find that rate throttling of outbound worm traffic, implemented in the network or hosts, can be effective in slowing down a new worm outbreak given sufficient coverage of hosts. An outbreak is slowed down exponentially as the fraction of protected hosts is increased. We also find that throttling both inbound and outbound traffic can be much more effective than rate throttling only outbound traffic. I. INTRODUCTION Automated worm programs take advantage of network con- nectivity to spread from infected hosts to vulnerable hosts. A worm such as SQL Slammer has been called limited because compromised hosts were put into a simple execution loop to send out 404-byte UDP packets containing a copy of the worm to random IP addresses as fast as they could transmit packets (1). Slammer was observed to saturate the bandwidth on many links and would probably have taken advantage of more bandwidth had it been available. Faster worm outbreaks will compel organizations to depend more on automated blocking defenses compared to manual responses such as software patching and reconfiguring router access lists and firewalls. Current automated worm defenses consist of antivirus software, firewalls, and intrusion detection or prevention systems (IDS/IPS) (2), (3). These defenses attempt to detect and then block worms by a combination of misuse detection and anomaly detection. Misuse detection based on signature matching is the preferred approach of com- mercial antivirus and IDS/IPS due to its accuracy in detecting known (and similar) worms. However, new signatures may take hours to days to develop, test, and distribute after an unknown worm is discovered. Anomaly detection looking for deviations from normal baseline behavior has the potential to detect new worms without a known signature. Commercial products often in- clude heuristic behavior-blocking rules in addition to signature matching. For example, SMTP worm blocking checks if the process initiating SMTP outgoing email is an attachment in the current email; if it is, this self-mailing software is blocked (3). Another heuristic rule may look for any signs of a buffer overflow exploit which is a type of attack often used by worms.