Research Article
PWC: A Proactive Worm Containment Solution for Enterprise Networks
@INPROCEEDINGS{10.1109/SECCOM.2007.4550364, author={Yoon-Chan Jhi and Peng Liu and Lunquan Li and Qijun Gu and Jiwu Jing and George Kesidis}, title={PWC: A Proactive Worm Containment Solution for Enterprise Networks}, proceedings={3rd International ICST Conference on Security and Privacy in Communication Networks}, publisher={IEEE}, proceedings_a={SECURECOMM}, year={2008}, month={6}, keywords={Cause effect analysis Computational modeling Computer crime Computer security Computer worms Costs Filters Immune system Internet Protocols}, doi={10.1109/SECCOM.2007.4550364} }- Yoon-Chan Jhi
Peng Liu
Lunquan Li
Qijun Gu
Jiwu Jing
George Kesidis
Year: 2008
PWC: A Proactive Worm Containment Solution for Enterprise Networks
SECURECOMM
IEEE
DOI: 10.1109/SECCOM.2007.4550364
Abstract
We propose PWC, a proactive worm containment solution for enterprises. PWC can stop - instead of slowing down - an infected host from releasing worm scans as early as after merely 4 scans. Motivated by the observation that a worm uses a sustained outgoing packet rate, PWC gains infection awareness seconds before a signature or filter can be generated. To overcome denial-of-service possibly caused by such smoking signs of infection, PWC develops two new white detection (detecting who are uninfected) techniques: (a) the vulnerability time window lemma, and (b) the relaxation analysis. PWC is signature-free thus it is immunized from polymorphic worms and timely in containing. PWC is also resilient to containment evading. PWC is not sensitive to worm scan rate, and not protocol specific. Due to white detection, PWC causes minimal denial-ofservice. Evaluation based on real traces and worm simulations demonstrates that PWC significantly outperforms Virus Throttle [1] in terms of number of released worm scans, number of hosts infected by local scans, and availability.