3rd International ICST Conference on Security and Privacy in Communication Networks

Research Article

PWC: A Proactive Worm Containment Solution for Enterprise Networks

  • @INPROCEEDINGS{10.1109/SECCOM.2007.4550364,
        author={Yoon-Chan Jhi and Peng Liu and Lunquan Li and Qijun Gu and Jiwu Jing and George Kesidis},
        title={PWC: A Proactive Worm Containment Solution for Enterprise Networks},
        proceedings={3rd International ICST Conference on Security and Privacy in Communication Networks},
        publisher={IEEE},
        proceedings_a={SECURECOMM},
        year={2008},
        month={6},
        keywords={Cause effect analysis  Computational modeling  Computer crime  Computer security  Computer worms  Costs  Filters  Immune system  Internet  Protocols},
        doi={10.1109/SECCOM.2007.4550364}
    }
    
  • Yoon-Chan Jhi
    Peng Liu
    Lunquan Li
    Qijun Gu
    Jiwu Jing
    George Kesidis
    Year: 2008
    PWC: A Proactive Worm Containment Solution for Enterprise Networks
    SECURECOMM
    IEEE
    DOI: 10.1109/SECCOM.2007.4550364
Yoon-Chan Jhi1,*, Peng Liu1,*, Lunquan Li1,*, Qijun Gu2, Jiwu Jing3, George Kesidis1,*
  • 1: The Pennsylvania State University, University Park, PA 16802
  • 2: Texas State University, San Marcos, TX 78666
  • 3: Chinese Academy of Sciences
*Contact email: jhi@cse.psu.edu, pliu@ist.psu.edu, lli@ist.psu.edu, kesidis@cse.psu.edu

Abstract

We propose PWC, a proactive worm containment solution for enterprises. PWC can stop - instead of slowing down - an infected host from releasing worm scans as early as after merely 4 scans. Motivated by the observation that a worm uses a sustained outgoing packet rate, PWC gains infection awareness seconds before a signature or filter can be generated. To overcome denial-of-service possibly caused by such smoking signs of infection, PWC develops two new white detection (detecting who are uninfected) techniques: (a) the vulnerability time window lemma, and (b) the relaxation analysis. PWC is signature-free thus it is immunized from polymorphic worms and timely in containing. PWC is also resilient to containment evading. PWC is not sensitive to worm scan rate, and not protocol specific. Due to white detection, PWC causes minimal denial-ofservice. Evaluation based on real traces and worm simulations demonstrates that PWC significantly outperforms Virus Throttle [1] in terms of number of released worm scans, number of hosts infected by local scans, and availability.