Article

Vigilante: end-to-end containment of internet worms

Authors:

Antony Rowstron,

Paul BarhamAuthors Info & Claims

SOSP '05: Proceedings of the twentieth ACM symposium on Operating systems principles

Pages 133 - 147

https://doi.org/10.1145/1095810.1095824

Published: 20 October 2005 Publication History

Abstract

Worm containment must be automatic because worms can spread too fast for humans to respond. Recent work has proposed network-level techniques to automate worm containment; these techniques have limitations because there is no information about the vulnerabilities exploited by worms at the network level. We propose Vigilante, a new end-to-end approach to contain worms automatically that addresses these limitations. Vigilante relies on collaborative worm detection at end hosts, but does not require hosts to trust each other. Hosts run instrumented software to detect worms and broadcast self-certifying alerts (SCAs) upon worm detection. SCAs are proofs of vulnerability that can be inexpensively verified by any vulnerable host. When hosts receive an SCA, they generate filters that block infection by analysing the SCA-guided execution of the vulnerable software. We show that Vigilante can automatically contain fast-spreading worms that exploit unknown vulnerabilities without blocking innocuous traffic.

References

[1]

Pax team. http://pax.grsecurity.net/.

[2]

Abadi, M., Budiu, M., Erlingsson, U., and Ligatti, J. Control-flow I ntegrity: Principles, implementations, and applications. In ACM CCS (Nov. 2005). To appear.

Digital Library

[3]

Akamai. Press release: Akamai helps mcafee.com support flash crowds from iloveyou virus, May 2000.

[4]

Barrantes, E. G., Ackley, D. H., Palmer, T. S., Stefanovic, D., and Zov, D. D. Randomized instruction set emulation to disrupt binary code injection attacks. In ACM CCS (Oct. 2003).

Digital Library

[5]

Bruening, D., Duesterwald, E., and Amarasinghe, S. Design and implementation of a dynamic optimization framework for Windows. In ACM FDD0 (Dec. 2000).

[6]

Castro, M., Druschel, P., Ganesh, A., Rowstron, A., and Wallach, D. S. Security for structured peer-to-peer overlay networks. In OSDI (Dec. 2002).

Digital Library

[7]

Chen, P., Joshi, A., King, S., and Dunlap, G. Detecting past and present intrusions through vulnerability-specific predicates. In SOSP (Oct. 2005).

Digital Library

[8]

Chen, Z., Gao, L., and Kwiat, K. Modelling the spread of active worms. In IEEE INFOCOM (Apr. 2003).

[9]

Costa, M., Crowcroft, J., Castro, M., and Rowstron, A. Can we contain I nternet worms? In HotNets (Nov. 2004).

[10]

Cowan, C., Pu, C., Maier, D., Hinton, H., Wadpole, J., Bakke, P., Beattie, S., Grier, A., Wagle, P., and Zhang, Q. Stackguard: Automatic detection and prevention of buffer-overrun attacks. In USENIX Security Symposium (Jan. 1998).

Digital Library

[11]

Crandall, J. R., and Chong, F. T. Minos: Control data attack prevention orthogonal to memory model. In MICRO-37 (Dec. 2004).

Digital Library

[12]

Douceur, J. R. The Sybil attack. In IPTPS (Mar. 2002).

Digital Library

[13]

Dunlap, G. W., King, S. T., Cinar, S., Basrai, M. A., and Chen, P. M. Revirt: Enabling intrusion analysis through virtual-machine logging and replay. In OSDI (Dec. 2002).

Digital Library

[14]

Elnozahy, E. N., Alvisi, L., Wang, Y.-M., and Johnson, D. B. A survey of rollback-recovery protocols in message-passing systems. ACM Computing Surveys 34, 3 (Sept. 2002), 375--408.

Digital Library

[15]

Fraser, K., and Chang, F. Operating System I/O Speculation: How two invocations are faster than one. In USENIX Annual Technical Conference (Jun. 2003).

[16]

Garfinkel, T., and Rosenblum, M. A virtual machine introspection based architecture for intrusion detection. In NDSS (Feb. 2003).

[17]

Georgatos, F., Gruber, F., Karrenberg, D., Santcroos, M., Uijterwaal, H., and Wilhelm, R. Providing A ctive M easurements as a R egular S ervice for ISP s. In PAM2001 (Apr. 2001). http://www.ripe.net/ttm.

[18]

Heberlein, L. T., Dias, G., K, L., Wood, B. M. J., and Wolber, D. A network security monitor. In Proceedings of the IEEE Symposium on Research in Privacy (1990).

[19]

Hethcote, H. W. The mathematics of infectious deseases. SIAM Review 42, 4 (2000), 599--653.

Digital Library

[20]

Hunt, G., and Brubacher, D. Detours: Binary interception of W in32 functions. In USENIX Windows NT Symposium (July 1999).

Digital Library

[21]

Kc, G. S., Keromytis, A. D., and Prevelakis, V. Countering code-injection attacks with instruction-set randomization. In ACM CCS (Oct. 2003).

Digital Library

[22]

Kim, H., and Karp, B. Autograph: Toward automated, distributed worm signature detection. In USENIX Security Symposium (Aug. 2004).

Digital Library

[23]

Kiriansky, V., Bruening, D., and Amarasinghe, S. P. Secure execution via program shepherding. In USENIX Security Symposium (Aug. 2002).

Digital Library

[24]

Kreibich, C., and Crowcroft, J. Honeycomb - creating intrusion detection signatures using honeypots. In HotNets (Nov. 2003).

[25]

Microsoft. Nirvana. http://www.microsoft.com/windows/cse/bit.mspx.

[26]

Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S., and Weaver, N. Inside the Slammer worm. IEEE Security and Privacy 1, 4 (Jul. 2003).

Digital Library

[27]

Moore, D., Shannon, C., Voelker, G., and Savage, S. Internet quarantine: Requirements for containing self-propagating code. In IEEE INFOCOM (Apr. 2003).

[28]

Necula, G. C., McPeak, S., and Weimer, W. CCured: type-safe retrofitting of legacy code. In POPL (Jan. 2002).

Digital Library

[29]

Newsome, J., Karp, B., and Song, D. Polygraph: Automatically generating signatures for polymorphic worms. In IEEE Symposium on Security and Privacy (May 2005).

Digital Library

[30]

Newsome, J., and Song, D. Dynamic taint analysis: Automatic detection and generation of software exploit attacks. In NDSS (Feb. 2005).

[31]

Paxson, V. Bro. a system for detecting network intruders in real time. Computer Networks 31, 23-24 (December 1999), 2435--2463.

Digital Library

[32]

Ptacek, T. H., and Newsham, T. N. Insertion, evasion, and denial of service: Eluding network intrusion detection. Tech. rep., Secure Networks, Inc, Jan. 1998.

[33]

Reps, T., and Rosay, G. Precise interprocedural chopping. In ACM SIGSOFT Symposium on Foundations of Software Engineering (1995).

Digital Library

[34]

Rinard, M., Cadar, C., Dumitran, D., Roy, D. M., Leu, T., and Jr., W. S. B. Enhancing server availability and security through failure-oblivious computing. In OSDI (Dec. 2004).

Digital Library

[35]

Roesch, M. Snort: Lightweight intrusion detection for networks.In Conference on Systems Administration (Nov. 1999).

Digital Library

[36]

Sidiroglou, S., and Keromytis, A. D. Countering network worms through automatic patch generation. IEEE Security and Privacy (2005).

Digital Library

[37]

Sidiroglou, S., Locasto, M. E., Boyd, S. W., and Keromytis, A. D. Building a reactive immune system for software services. In Usenix Technical Conference (Apr. 2005).

Digital Library

[38]

Singh, S., Estan, C., Varghese, G., and Savage, S. Automated worm fingerprinting. In OSDI (Dec. 2004).

Digital Library

[39]

Smirnov, A., and cker Chiueh, T. DIRA: Automatic detection, identification, and repair of control-hijacking attacks. In NDSS (Feb. 2005).

[40]

SPEC. Specweb99 benchmark. http://www.spec.org/osg/web99.

[41]

Staniford, S., Moore, D., Paxson, V., and Weaver, N. The top speed of flash worms. In WORM (Oct. 2004).

Digital Library

[42]

Staniford, S., Paxson, V., and Weaver, N. How to 0wn the internet in your spare time. In USENIX Security Symposium (Aug. 2002).

Digital Library

[43]

Suh, G. E., Lee, J., and Devadas, S. Secure program execution via dynamic information flow tracking. In ASPLOS XI (Oct. 2004).

Digital Library

[44]

TPC. Tpc-c online transaction processing benchmark. http://www.tpc.org/tpcc/default.asp.

[45]

Wang, H. J., Guo, C., Simon, D. R., and Zugenmaier, A. Shield: Vulnerability-driven network filters for preventing known vulnerability exploits. In ACM SIGCOMM (Aug. 2004).

Digital Library

[46]

Weaver, N., Staniford, S., and Paxson, V. Very fast containment of scanning worms. In USENIX Security Symposium (Aug. 2004).

Digital Library

[47]

Wilander, J., and Kamkar, M. A comparison of publicly available tools for dynamic buffer overflow prevention. In NDSS (Feb. 2003).

[48]

Williamnson, M. M. Throttling viruses: Restricting propagation to defeat mobile malicious code. ACSAC (2002).

Digital Library

[49]

Zegura, E., Calvert, K., and Bhattacharjee, S. How to model an internetwork. In IEEE INFOCOM (Mar. 1996).

Digital Library

[50]

Zou, C. C., Gao, L., Gong, W., and Towsley, D. Monitoring and early warning for internet worms. In ACM CCS (Oct. 2003).

Digital Library

Cited By

Essouifi MLachgar AVasudevan MB'ayir CAchahbar AElkhamkhami J(2024)Automated Hubs-Patching: Protection Against Malware Spread Through Reduced Scale-Free Networks and External Storage DevicesIEEE Transactions on Network Science and Engineering10.1109/TNSE.2024.340108111:5(4758-4773)Online publication date: Sep-2024
https://doi.org/10.1109/TNSE.2024.3401081
Farahmandi FRahman MRajendran STehranipoor MFarahmandi FRahman MRajendran STehranipoor M(2023)CAD for Information Leakage AssessmentCAD for Hardware Security10.1007/978-3-031-26896-0_4(81-102)Online publication date: 28-Jan-2023
https://doi.org/10.1007/978-3-031-26896-0_4
Lefeuvre HBădoiu VJung ATeodorescu SRauch SHuici FRaiciu COlivier PFalsafi BFerdman MLu SWenisch T(2022)FlexOS: towards flexible OS isolationProceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems10.1145/3503222.3507759(467-482)Online publication date: 28-Feb-2022
https://dl.acm.org/doi/10.1145/3503222.3507759
Show More Cited By

Index Terms

Vigilante: end-to-end containment of internet worms

Recommendations

Vigilante: end-to-end containment of internet worms
SOSP '05

Worm containment must be automatic because worms can spread too fast for humans to respond. Recent work has proposed network-level techniques to automate worm containment; these techniques have limitations because there is no information about the ...
Vigilante: End-to-end containment of Internet worm epidemics

Worm containment must be automatic because worms can spread too fast for humans to respond. Recent work proposed network-level techniques to automate worm containment; these techniques have limitations because there is no information about the ...
WormTerminator: an effective containment of unknown and polymorphic fast spreading worms
ANCS '06: Proceedings of the 2006 ACM/IEEE symposium on Architecture for networking and communications systems

The fast spreading worm is becoming one of the most serious threats to today's networked information systems. A fast spreading worm could infect hundreds of thousands of hosts within a few minutes. In order to stop a fast spreading worm, we need the ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

SOSP '05: Proceedings of the twentieth ACM symposium on Operating systems principles

October 2005

259 pages

ISBN:1595930795

DOI:10.1145/1095810

General Chair:
Andrew Herbert
Microsoft Research, UK
,
Program Chair:
Ken Birman
Cornell University, USA

ACM SIGOPS Operating Systems Review Volume 39, Issue 5
SOSP '05
December 2005
290 pages
ISSN:0163-5980
DOI:10.1145/1095809
Issue’s Table of Contents

Copyright © 2005 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 20 October 2005

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Article

Conference

SOSP05

Sponsor:

SOSP05: ACM SIGOPS 20th Symposium on Operating Systems Principles 2005

October 23 - 26, 2005

Brighton, United Kingdom

Acceptance Rates

Overall Acceptance Rate 174 of 961 submissions, 18%

Upcoming Conference

SOSP '25

Sponsor:
sigops

ACM SIGOPS 31st Symposium on Operating Systems Principles

October 13 - 16, 2025

Seoul , Republic of Korea

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

370
Total Citations
View Citations
2,241
Total Downloads

Downloads (Last 12 months)24
Downloads (Last 6 weeks)0

Reflects downloads up to 02 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

Essouifi MLachgar AVasudevan MB'ayir CAchahbar AElkhamkhami J(2024)Automated Hubs-Patching: Protection Against Malware Spread Through Reduced Scale-Free Networks and External Storage DevicesIEEE Transactions on Network Science and Engineering10.1109/TNSE.2024.340108111:5(4758-4773)Online publication date: Sep-2024
https://doi.org/10.1109/TNSE.2024.3401081
Farahmandi FRahman MRajendran STehranipoor MFarahmandi FRahman MRajendran STehranipoor M(2023)CAD for Information Leakage AssessmentCAD for Hardware Security10.1007/978-3-031-26896-0_4(81-102)Online publication date: 28-Jan-2023
https://doi.org/10.1007/978-3-031-26896-0_4
Lefeuvre HBădoiu VJung ATeodorescu SRauch SHuici FRaiciu COlivier PFalsafi BFerdman MLu SWenisch T(2022)FlexOS: towards flexible OS isolationProceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems10.1145/3503222.3507759(467-482)Online publication date: 28-Feb-2022
https://dl.acm.org/doi/10.1145/3503222.3507759
Hossain MHan JSchneider JJiang JKabir MVersteeg S(2022)Extracting Formats of Service Messages with Varying PayloadsACM Transactions on Internet Technology10.1145/350315922:3(1-31)Online publication date: 1-Feb-2022
https://dl.acm.org/doi/10.1145/3503159
Li WMeng WKwok L(2022)Surveying Trust-Based Collaborative Intrusion Detection: State-of-the-Art, Challenges and Future DirectionsIEEE Communications Surveys & Tutorials10.1109/COMST.2021.313905224:1(280-305)Online publication date: Sep-2023
https://doi.org/10.1109/COMST.2021.3139052
Malik SRafiq MKahloon M(2021)Cloud Security in E-Commerce ApplicationsResearch Anthology on E-Commerce Adoption, Models, and Applications for Modern Business10.4018/978-1-7998-8957-1.ch085(1720-1732)Online publication date: 2021
https://doi.org/10.4018/978-1-7998-8957-1.ch085
Brant CShrestha PMixon-Baca BChen KVarlioglu SElsayed NJin YCrandall JOliveira D(2021)Challenges and Opportunities for Practical and Effective Dynamic Information Flow TrackingACM Computing Surveys10.1145/348379055:1(1-33)Online publication date: 23-Nov-2021
https://dl.acm.org/doi/10.1145/3483790
Yagemann CChung SSaltaformaggio BLee WKim YKim JVigna GShi E(2021)Automated Bug Hunting With Data-Driven Symbolic Root Cause AnalysisProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security10.1145/3460120.3485363(320-336)Online publication date: 12-Nov-2021
https://dl.acm.org/doi/10.1145/3460120.3485363
Bao TShoshitaishvili Y(2021)Cyber Autonomy in Software Security: Techniques and TacticsGame Theory and Machine Learning for Cyber Security10.1002/9781119723950.ch12(204-229)Online publication date: 12-Sep-2021
https://doi.org/10.1002/9781119723950.ch12
Malik SRafiq MKahloon M(2020)Cloud Security in E-Commerce ApplicationsCloud Computing Applications and Techniques for E-Commerce10.4018/978-1-7998-1294-4.ch003(50-67)Online publication date: 2020
https://doi.org/10.4018/978-1-7998-1294-4.ch003
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten