Internet quarantine: requirements for containing self-propagating code

TLDR

Self‑propagating code can rapidly spread across networks, and recent worm outbreaks such as Code‑Red have highlighted the growing frequency and severity of these attacks, prompting extensive research into detection and containment methods. This study asks how effectively any worm‑containment approach can curb an Internet worm epidemic, rather than proposing a specific technology. The authors analyze worm containment systems by modeling three key parameters—reaction time, containment strategy, and deployment scenario—using analytic and simulation techniques to determine their impact on epidemic dynamics and the minimum engineering requirements. Their analysis shows that current defenses fall short of the lower bounds needed for effective containment, revealing significant technological and administrative gaps that must be addressed.

Abstract

It has been clear since 1988 that self-propagating code can quickly spread across a network by exploiting homogeneous security vulnerabilities. However, the last few years have seen a dramatic increase in the frequency and virulence of such "worm" outbreaks. For example, the Code-Red worm epidemics of 2001 infected hundreds of thousands of Internet hosts in a very short period - incurring enormous operational expense to track down, contain, and repair each infected machine. In response to this threat, there is considerable effort focused on developing technical means for detecting and containing worm infections before they can cause such damage. This paper does not propose a particular technology to address this problem, but instead focuses on a more basic question: How well will any such approach contain a worm epidemic on the Internet? We describe the design space of worm containment systems using three key parameters - reaction time, containment strategy and deployment scenario. Using a combination of analytic modeling and simulation, we describe how each of these design factors impacts the dynamics of a worm epidemic and, conversely, the minimum engineering requirements necessary to contain the spread of a given worm. While our analysis cannot provide definitive guidance for engineering defenses against all future threats, we demonstrate the lower bounds that any such system must exceed to be useful today. Unfortunately, our results suggest that there are significant technological and administrative gaps to be bridged before an effective defense can be provided in today's Internet.