Dynamic Quarantine of Internet Worms

If we limit the contact rate of worm traffic, can we alleviate and ultimately contain Internet worms? This paper sets out to answer this question. Specifically, we are interested in analyzing different deployment strategies of rate control mechanisms and the effect thereof on suppressing the spread of worm code. We use both analytical models and simulation experiments. We find that rate control at individual hosts or edge routers yields a slowdown that is linear in the number of hosts (or routers) with the rate limiting filters. Limiting contact rate at the backbone routers, however, is substantially more effective--it renders a slowdown comparable to deploying rate limiting filters at every individual host that is covered. This result holds true even when susceptible and infected hosts are patched and immunized dynamically. To provide context for our analysis, we examine real traffic traces obtained from a campus computing network. We observe that rate throttling could be enforced wi...

• Type: Conference
• Year: 2004
• Where: DSN
• Authors: Cynthia Wong, Chenxi Wang, Dawn Xiaodong Song, Stan Bielski, Gregory R. Ganger
• Keywords: Computer Networks, Contact Rate, DSN 2004, Rate Control, Rate Limiting Filters