PWC: a proactive worm containment solution for enterprise networks

Abstract

AbstractWe propose PWC, a proactive worm containment solution for enterprises. PWC can stop—instead of just slow down—an infected host from releasing worm scans as early as after merely four scans. Motivated by the observation that a worm uses a sustained outgoing packet rate, PWC gains infection awareness seconds before a signature or filter can be generated. To overcome denial‐of‐service possibly caused by such characteristic indicators of infection, PWC/,develops two new white detection (detecting who are uninfected) techniques: (a) the vulnerability time window lemma, and (b) the relaxation analysis. PWC does not rely on contents‐based signatures thus it can defend against polymorphic worms timely in containment. PWC is also resilient to containment evading. PWC is not sensitive to worm scan rate, and not protocol specific. Due to white detection, PWC causes minimal denial‐of‐service. Evaluation based on real traces and worm simulations demonstrates that PWC significantly outperforms Virus Throttle in terms of number of released worm scans, number of hosts infected by local scans, and denial‐of‐service effects. Copyright © 2009 John Wiley & Sons, Ltd.