End-to-End Containment of Internet Worm Epidemics

摘要: Worms — programs that self-replicate automatically over computer networks are a serious threat to hosts connected the Internet. They infect by exploiting software vulnerabilities, and they can use their victims for many malicious activities. Past outbreaks show worms spread too fast humans respond, hence worm containment must be automatic. Recent work proposed network-level techniques automate containment, but these have limitations because there is no information about vulnerabilities at network level. We propose Vigilante: new end-to-end architecture contain addresses limitations. In Vigilante, detect instrumenting vulnerable analyze infection attempts. introduce dynamic data-flow analysis: broadcoverage host-based algorithm unknown worms, tracking flow of data from messages, disallowing unsafe uses data. also how integrate other detection mechanisms into Vigilante architecture. Upon detection, generate self-certifying alerts (SCAs), type security alert inexpensively verified any host. Using SCAs, cooperate an outbreak, without having trust each other. broadcasts SCAs overlay propagates rapidly resiliently. Hosts receiving SCA protect themselves generating filters with vulnerability condition slicing: performs analysis program identify control-flow conditions lead successful attacks. These block attack, including all mutations follow execution path identified SCA, while introducing negligible performance overhead. Our results spreading exploit false positives. does not require changes hardware, compilers, operating systems or source code programs; therefore, it used as exists today in binary form.