WORM vs. WORM: preliminary study of an active counter-attack mechanism

Self-propagating computer worms have been terrorizing the Internet for the last several years. With the increasing density, inter-connectivity and bandwidth of the Internet combined with security measures that inadequately scale, worms will continue to plague the Internet community. Existing anti-virus and intrusion detection systems are clearly inadequate to defend against many recent fast-spreading worms. In this paper we explore an active counter-attack method anti-worms. We propose a method that transforms a malicious worm into an anti-worm which disinfects its original. The method is evaluated using the CodeRed, Blaster and Slammer worms. We show through simulation the effectiveness of an anti-worm with several propagation schemes and its impact on the overall network. We also discuss important limitations of the proposed method. Categories and Subject Descriptors D.4.6 [Operating Systems]: Security and Protection--invasive software (e.g., viruses, worms, Trojan horses); C.2.0 [C...

• Type: Conference
• Year: 2004
• Where: WORM
• Authors: Frank Castaneda, Emre Can Sezer, Jun Xu
• Keywords: Counter-attack Method Anti-worms, Security, Security Privacy, Trojan Horses, WORM 2004