Can we contain Internet worms

摘要: Worm containment must be automatic because worms can spread too fast for humans to respond. Recent work has proposed a network centric approach automate worm containment: traffic is analyzed derive packet classifier that blocks (or rate-limits) propagation. This fundamental limitations the analysis no information about application vulnerabilities exploited by worms. paper proposes Vigilante, new host addresses these limitations. Vigilante relies on collaborative detection at end hosts in Internet but does not require trust each other. Hosts detect analysing attempts infect applications and broadcast self-certifying alerts (SCAs) when they worm. SCAs are automatically generated machine-verifiable proofs of vulnerability; independently inexpensively verified any host. use generate filters or patches prevent infection. We present preliminary results showing effectively contain spreading exploit unknown vulnerabilities.