Vigilante

TLDR

Worms spread too quickly for human response, so automatic containment is essential, yet existing network‑level methods lack vulnerability information. This work introduces Vigilante, an end‑to‑end system that automatically contains worms by overcoming those limitations. Vigilante uses collaborative, trust‑free worm detection at end hosts, where instrumented software emits self‑certifying alerts that prove vulnerabilities, and upon receipt hosts generate filters that block infection based on the alert’s guided execution. Evaluation shows Vigilante can automatically contain fast‑spreading worms exploiting unknown vulnerabilities while preserving benign traffic.

Abstract

Worm containment must be automatic because worms can spread too fast for humans to respond. Recent work has proposed network-level techniques to automate worm containment; these techniques have limitations because there is no information about the vulnerabilities exploited by worms at the network level. We propose Vigilante, a new end-to-end approach to contain worms automatically that addresses these limitations. Vigilante relies on collaborative worm detection at end hosts, but does not require hosts to trust each other. Hosts run instrumented software to detect worms and broadcast self-certifying alerts (SCAs) upon worm detection. SCAs are proofs of vulnerability that can be inexpensively verified by any vulnerable host. When hosts receive an SCA, they generate filters that block infection by analysing the SCA-guided execution of the vulnerable software. We show that Vigilante can automatically contain fast-spreading worms that exploit unknown vulnerabilities without blocking innocuous traffic.