PWC: A proactive worm containment solution for enterprise networks

Yoon Chan Jhi, Peng Liu, Lunquan Li, Qijun Gu, Jiwu Jing, George Kesidis

Research output: Contribution to journalArticle

2 Scopus citations

Abstract

We propose PWC, a proactive worm containment solution for enterprises. PWC can stop-instead of just slow down-an infected host from releasing worm scans as early as after merely four scans. Motivated by the observation that a worm uses a sustained outgoing packet rate, PWC gains infection awareness seconds before a signature or filter can be generated. To overcome denial-of-service possibly caused by such characteristic indicators of infection, PWC develops two new white detection (detecting who are uninfected) techniques: (a) the vulnerability time window lemma, and (b) the relaxation analysis. PWC does not rely on contents-based signatures thus it can defend against polymorphic worms timely in containment. PWC is also resilient to containment evading. PWC is not sensitive to worm scan rate, and not protocol specific. Due to white detection, PWC causes minimal denial-of-service. Evaluation based on real traces and worm simulations demonstrates that PWC significantly outperforms Virus Throttle in terms of number of released worm scans, number of hosts infected by local scans, and denial-of-service effects.

Original languageEnglish (US)
Pages (from-to)334-354
Number of pages21
JournalSecurity and Communication Networks
Volume3
Issue number4
DOIs
StatePublished - Jan 1 2010

All Science Journal Classification (ASJC) codes

  • Information Systems
  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'PWC: A proactive worm containment solution for enterprise networks'. Together they form a unique fingerprint.

  • Cite this