Can we contain Internet worms
Manuel Costa, Jon Crowcroft, Miguel Castro, Antony I.T. Rowstron · 2004
Worm containment must be automatic because worms can spread too fast for humans to respond. Recent work has pro-posed a network centric approach to automate worm contain-ment: network traffic is analyzed to derive a packet classifier that blocks (or rate-limits) worm propagation. This approach has fundamental limitations because the analysis has no in-formation about the application vulnerabilities exploited by worms. This paper proposes Vigilante, a new host centric ap-proach for automatic worm containment that addresses these limitations. Vigilante relies on collaborative worm detection at end hosts in the Internet but does not require hosts to trust each other. Hosts detect worms by analysing attempts to in-fect applications and broadcast self-certifying alerts (SCAs) when they detect a worm. SCAs are automatically generated machine-verifiable proofs of vulnerability; they can be inde-pendently and inexpensively verified by any host. Hosts can use SCAs to generate filters or patches that prevent infec-tion. We present preliminary results showing that Vigilante can effectively contain fast spreading worms that exploit un-known vulnerabilities. 1.