Vigilante: End-to-End Containment of Internet Worm Epidemics

DMCA

Vigilante: End-to-End Containment of Internet Worm Epidemics (2008)

Cached

Download Links

by Manuel Costa , Jon Crowcroft , Miguel Castro , Antony Rowstron , Lidong Zhou , Lintao Zhang , Paul Barham

Citations:

296 - 6 self

BibTeX

@MISC{Costa08vigilante:end-to-end,
    author = {Manuel Costa and Jon Crowcroft and Miguel Castro and Antony Rowstron and Lidong Zhou and Lintao Zhang and Paul Barham},
    title = { Vigilante: End-to-End Containment of Internet Worm Epidemics},
    year = {2008}
}

OpenURL

Abstract

Worm containment must be automatic because worms can spread too fast for humans to respond. Recent work proposed network-level techniques to automate worm containment; these techniques have limitations because there is no information about the vulnerabilities exploited by worms at the network level. We propose Vigilante, a new end-to-end architecture to contain worms automatically that addresses these limitations. In Vigilante, hosts detect worms by instrumenting vulnerable programs to analyze infection attempts. We introduce dynamic data-flow analysis: a broad-coverage host-based algorithm that can detect unknown worms by tracking the flow of data from network messages and disallowing unsafe uses of this data. We also show how to integrate other host-based detection mechanisms into the Vigilante architecture. Upon detection, hosts generate self-certifying alerts (SCAs), a new type of security alert that can be inexpensively verified by any vulnerable host. Using SCAs, hosts can cooperate to contain an outbreak, without having to trust each other. Vigilante broadcasts SCAs over an overlay network that propagates alerts rapidly and resiliently. Hosts receiving an SCA protect themselves by generating filters with vulnerability condition slicing: an algorithm that performs dynamic analysis of the vulnerable program to identify control-flow conditions that lead

Keyphrases

internet worm epidemic end-to-end containment worm containment vulnerable program dynamic analysis network level network-level technique vulnerable host recent work infection attempt unknown worm vulnerability condition slicing self-certifying alert dynamic data-flow analysis host-based detection mechanism unsafe us network message control-flow condition new type overlay network broad-coverage host-based algorithm sca protect vigilante architecture new end-to-end architecture security alert

DMCA