On the Development of an Internetwork-Centric Defense for Scanning Worms

Studies of worm outbreaks have found that the speed of worm propagation makes manual intervention ineffective. Consequently, many automated containment mechanisms have been proposed to contain worm outbreaks before they grow out of control. These containment systems, however, only provide protection for hosts within networks that implement them. Such a containment strategy requires complete participation to protect all vulnerable hosts. Moreover, collaborative containment systems, where participants share alert data, face a tension between resilience to false alerts and quick reaction to worm outbreaks. This paper suggests an alternative approach where an autonomous system in an internetwork, such as the Internet, protects not only its local hosts, but also all hosts that route traffic through it, which we call internetwork-centric containment. Additionally, we propose a novel reputation-based alerting mechanism to provide fast dissemination of infection information while maintaining...

• Type: Conference
• Year: 2007
• Where: HICSS
• Authors: Scott E. Coull, Boleslaw K. Szymanski
• Keywords: Biometrics, Containment, Containment Systems, HICSS 2007, System Sciences, Worm Outbreaks