Published Articles >> Table of Contents >> Abstract

2004 International Conference on Dependable Systems and Networks (DSN'04)   p. 73
Dynamic Quarantine of Internet Worms
Cynthia Wong, Carnegie Mellon University
Chenxi Wang, Carnegie Mellon University
Dawn Song, Carnegie Mellon University
Stan Bielski, Carnegie Mellon University
Gregory R. Ganger, Carnegie Mellon University

Full Article Text:

DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/DSN.2004.1311878
Send link to a friend

Abstract
If we limit the contact rate of worm traffic, can we alleviate and ultimately contain Internet worms? This paper sets out to answer this question. Specifically, we are interested in analyzing different deployment strategies of rate control mechanisms and the effect thereof on suppressing the spread of worm code. We use both analytical models and simulation experiments. We find that rate control at individual hosts or edge routers yields a slowdown that is linear in the number of hosts (or routers) with the rate limiting filters. Limiting contact rate at the backbone routers, however, is substantially more effective-it renders a slow-down comparable to deploying rate limiting filters at every individual host that is covered. This result holds true even when susceptible and infected hosts are patched and immunized dynamically. To provide context for our analysis, we examine real traffic traces obtained from a campus computing network. We observe that rate throttling could be enforced with minimal impact on legitimate communications. Two worms observed in the traces, however, would be significantly slowed down.
Back to Top Additional Information
Citation:  Cynthia Wong, Chenxi Wang, Dawn Song, Stan Bielski, Gregory R. Ganger, "Dynamic Quarantine of Internet Worms," dsn, p. 73,  2004 International Conference on Dependable Systems and Networks (DSN'04),  2004