Analyzing cooperative containment of fast scanning worms

Authors:
Jayanthkumar Kannan;Lakshminarayanan Subramanian;Ion Stoica;Randy H. Katz
Affiliations:
Computer Science Division, University of California, Berkeley;Computer Science Division, University of California, Berkeley;Computer Science Division, University of California, Berkeley;Computer Science Division, University of California, Berkeley
Venue:
SRUTI'05 Proceedings of the Steps to Reducing Unwanted Traffic on the Internet on Steps to Reducing Unwanted Traffic on the Internet Workshop
Year:
2005

Citing 8
Cited 3

How to Own the Internet in Your Spare Time

Proceedings of the 11th USENIX Security Symposium
Designing a Framework for Active Worm Detection on Global Networks

IEEE-IWIA '03 Proceedings of the First IEEE International Workshop on Information Assurance (IWIA'03)
Dynamic Quarantine of Internet Worms

DSN '04 Proceedings of the 2004 International Conference on Dependable Systems and Networks
Preliminary results using scale-down to explore worm dynamics

Proceedings of the 2004 ACM workshop on Rapid malcode
Implementing and testing a virus throttle

SSYM'03 Proceedings of the 12th conference on USENIX Security Symposium - Volume 12
Very fast containment of scanning worms

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
Autograph: toward automated, distributed worm signature detection

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
Worms vs. perimeters: the case for hard-LANs

HOTI '04 Proceedings of the High Performance Interconnects, 2004. on Proceedings. 12th Annual IEEE Symposium

Peer to peer networks for defense against internet worms

Interperf '06 Proceedings from the 2006 workshop on Interdisciplinary systems approach in performance evaluation and design of computer & communications sytems
WormShield: Fast Worm Signature Generation with Distributed Fingerprint Aggregation

IEEE Transactions on Dependable and Secure Computing
Robust reactions to potential day-zero worms through cooperation and validation

ISC'06 Proceedings of the 9th international conference on Information Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

Fast scanning worms, that can infect nearly the entire vulnerable population in order of minutes, are among the most serious threats to the Internet today. In this work, we investigate the efficacy of cooperation among Internet firewalls in containing such worms. We first propose a model for firewall-level cooperation and then study the containment in our model of cooperation using analysis and simulation. Our results suggest that, with moderate overhead, cooperation among Internet firewalls can provide 95% containment under 10% deployment while being resilient to 100-1000 malicious firewalls.