Implementing and testing a virus throttle

Twycross, Joseph Williamson

Description

Implementing and testing a virus throttle

Sujets

• Arts

Informations

• Publié par: onytodor
• Nombre de lectures: 60
• Langue: English

Extrait

1 Implementing and testing a virus throttle Jamie Twycross, Matthew M. Williamson Trusted Systems Laboratory HP Laboratories Bristol HPL2003103 st May 21 , 2003* Email:[e-mail],[e-mail] In this paper we build on previous theoretical work and describe the implementation and testing of avirus throttle a program, based on a new approach, that is able to substantially reduce the spread of and hence damage caused by mobile code such as worms and viruses. Our approach is different from current, signaturebased antivirus paradigms in that it identifies potential viruses based on their network behaviour and, instead of preventing such progr ams from entering a system, seeks to prevent them from leaving. The results presented here show that such an approach is effective in stopping the spread of a real worm, W32/NimdaD, in under a second, as well as several different configurations of a testworm.

* Internal Accession Date Only Approved for External Publication 1 th th Proceedings 12 USENIX Security Symposium, 48 August 2003, Washington, DC, USA ãCopyright HewlettPackard Company 2003