Design space and analysis of worm defense strategies

Proceedings of the 2006 ACM Symposium on Information, Computer and Communications Security, ASIACCS '06

Volumn 2006, Issue , 2006, Pages 125-137

  Brumley, David ^a   Liu, Li Hao ^a   Poosankam, Pongsin ^a   Song, Dawn ^a  

^a CARNEGIE MELLON UNIVERSITY   (United States)

Author keywords

Antibody; Blacklisting; Defense strategy analysis; Local containment; Proactive protection; Worm propagation; Worm taxonomy; Worms

Indexed keywords

BLACKLISTING; DEFENSE STRATEGY ANALYSIS; LOCAL CONTAINMENT; PROACTIVE PROTECTION; WORM PROPAGATION; WORM TAXONOMY;

ABSTRACTING; MATHEMATICAL MODELS; PARAMETER ESTIMATION; SECURITY OF DATA; TAXONOMIES;

COMPUTER WORMS;

EID: 33751035317     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1128817.1128837     Document Type: Conference Paper

References (32)

1. PaX. http://pax.grsecurity.net/.
2. E. G. Barrantes, D. H. Ackley, S. Forrest, T. S. Palmer, D. Stefanovic, and D. D. Zovi. Intrusion detection: Randomized instruction set emulation to disrupt binary code injection attacks. In 10th ACM International Conference on Computer and Communications Security (CCS), October 2003.
3. E. G. Barrantes, D. H. Ackley, S. Forrest, and D. Stefanovic. Randomized instruction set emulation. ACM Transactions on Information and System Security, 8(1):3-40, 2005.
4. S. Bhatkar, D. C. DuVarney, and R. Sekar. Address obfuscation: An efficient approach to combat a broad range of memory error exploits. In Proceedings of 12th USENIX Security Symposium, 2003.
5. S. Bhatkar, R. Sekar, and D. C. DuVarney. Efficient techniques for comprehensive protection from memory error exploits. In Proceedings of the 14th USENIX Security Symposium, 2005.
6. Z. Chen, L. Gao, and K. Kwiat. Modeling the spread of active worms. 2003.
7. M. Chew and D. Song. Mitigating buffer overflows by operating system randomization. Technical report, Carnegie Mellon University, 2002.
8. C. Cowan, S. Beattie, J. Johansen, and P. Wagle. Poiritguard: Protecting pointers from buffer overflow vulnerabilities. In Proceedings of the 12th USENIX Security Symposium, 2003.
9. D. C. DuVarney, R. Sekar, and Y.-J. Lin. Benign software mutations: A novel approach to protect against large-scale network attacks. Center for Cybersecurity White Paper, October 2002.
10. S. Forrest, A. Somayaji, and D. H. Ackley. Building diverse computer systems. In Proceedings of 6th workshop on Hot Topics in operating Systems, 1997.
11. H. W. Hethcote. The Mathematics of Infectious Diseases. SIAM Review, 42(4):599-653, 2000.
12. G. S. Kc, A. D. Keromytis, and V. Prevelakis. Countering code-injection attacks with instruction-set randomization. In 10th ACM International Conference on Computer and Communications Security (CCS), October 2003.
13. H.-A. Kim and B. Karp. Autograph: toward automated, distributed worm signature detection. In Proceedings of the 13th USENIX Security Symposium, August 2004.
14. C. Kreibich and J. Crowcroft. Honeycomb - creating intrusion detection signatures using horieypots. In Proceedings of the Second Workshop on Hot Topics in Networks (UotNets-11), November 2003.
15. M. Liljenstam and D. Nicol. Comparing passive and active worm defenses. 2004.
16. D. Moore, V. Paxson, C. Shannon, G. M. Voelker, and S. Savage. Internet quarantine: Requirements for containing self-propagating code. In Proceedings of IEEE INFOCOM, March 2003.
17. D. Moore, S. Savage, C. Shannon, S. Stanilbrd, and N. Weaver. Inside the Slammer worm. IEEE Security and Privacy, July 2003.
18. D. Moore, C. Shannon, and J. Brown. Code-Red: a case study on the spread and victims of an internet worm. In Proceedings of ACM/USENIX Internet Measurement Workshop, France, November 2002.
19. J. Newsorne, B. Karp, and D. Song. Polygraph: Automatically generating signatures for polymorphic worms. In Proceedings of the IEEE Symposium on Security and Privacy, May 2005.
20. J. Newsome and D. Song. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. Technical Report CMU-CS-04-140, Carnegie Mellon University, 2004.
21. J. Newsome and D. Song. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In Proceedings of the 12th Annual Network and Distributed Systems Security Symposium, February 2005.
22. P. Porras, L. Briesemeister, K. Skinner, K. Levitt, J. Rowe, arid Y.-C. A. Ting. A hybrid quarantine defense. In Proceedings of the 2004 ACM Workshop on Rapid Malcode (WORM), Washington, DC, USA, 2004.
23. H. Shacham, M. Page, B. Pfaff, E.-J. Goh, N. Modadugu, and D. Boneh. On the effectiveness of address-space randomization. In Proceedings of the 11th ACM Conference on Computer and Communications Security, October 2004.
24. S. Sidiroglou and A. D. Keromytis. Countering network worms through automatic patch generation. In Proceedings of IEEE Symposium on Security and Privacy, 2005.
25. S. Singh, C. Estan, G. Varghese, and S. Savage. Automated worm fingerprinting. In Proceedings of the 6th ACM/USENIX Symposium on Operating System Design and Implementation (OSDI), December 2004.
26. N. Sovarel, D. Evans, and N. Paul. Where's the feeb? the effectiveness of instruction set randomization. In 14th USENIX Security Symposium, August 2005.
27. S. Stamford, V. Paxson, and N. Weaver. How to Own the internet in your spare time. In Proceedings of 11th USENIX Security Symposium, August 2002.
28. J. Twycross and M. M. Williamson. Implementing and testing a virus throttle. In Proceedings of 12th USENIX Security Symposium, August 2003.
29. M. M. Williamson. Throttling viruses: Restricting propagation to defeat malicious mobile code. In Proceedings of the 18th Annual Computer Security Applications Conference, 2002.
30. J. Xu, Z. Kalbarczyk, and R. K. Iyer. Transparent runtime randomization for security. Technical report, Center for Reliable and Higher Performance Computing, University of Illinois at Urbana-Champaign, May 2003.
31. C. Zou, W. Gong, D. Towsley, and L. Gao. The monitoring and early detection of internet worms. IEEE/ACM Transaction on Networking, To appear.
32. C. Zou, D. Towsley, and W. Gong. On the performance of internet worm scanning strategies. Journal of Performance Evaluation, To appear.