The Spread of the Sapphire/Slammer Worm

By David Moore, Vern Paxson, Stefan Savage, Colleen Shannon, Stuart Staniford, Nicholas C. Weaver. 2003

326 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/79185c646fbb999ef6c4cd24f09777714771c38c

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Data streaming algorithms for efficient and accurate estimation of flow size distribution (2004, background): “This period overlaps the onset of Slammer worm [18].”
Testing static analysis tools using exploitable buffer overflows from open source code (2004, methodology): “These include static analysis to discover and eliminate bu.er over.ows during software development, dynamic analysis to discover bu.er over.ows during software testing, dynamic prevention to detect bu.er over.ows when they occur after software has been deployed, and the use of memory-safe…”
Sketch-based change detection: methods, evaluation, and applications (2003, background): “…of California Florham Park, NJ, USA Berkeley, CA, USA {bala,sen,yzhang}@research.att.com yanchen@cs.berkeley.edu ABSTRACT Traf.c anomalies such as failures and attacks are commonplace in today s network, and identifying them rapidly and accurately is critical for large network operators.”
Address Space Layout Permutation (ASLP): Towards Fine-Grained Randomization of Commodity Software (2006, background): “Ideally, the current fastest known spreading worm, The Sapphire/Slammer[17], is able to infect 100% of vulnerable hosts in less than a minute by doubling in size every one second with no randomization address space.”
Automatically inferring patterns of resource consumption in network traffic (2003, methodology): “observation [12] that for some values of the random seed, the algorithm used by the worm to select target addresses chooses them from a limited set.”
Building a better NetFlow (2004, unknown): “It appears that the size of the histogram needs to increase linearly with the number of packets that can be sampled at the maximum sampling rate, imposing scalability problems.”
Monitoring and early warning for internet worms (2003, methodology): “On January 25th 2003, the SQL worm spread much more quickly on the Internet [20], [15].”
Estimating flow distributions from sampled flow statistics (2005, methodology): “Indeed, [17] reports the largest directly observed attack rate from a host of 26,000 scans per second.”
Preventing Internet denial-of-service with capabilities (2004, background): “The CodeRed and follow-on viruses have demonstrated repeatedly that it is possible to recruit millions of machines to the task of sending normal HTTP requests to a single destination [13] [12].”
Global Intrusion Detection in the DOMINO Overlay System (2004, background): “Furthermore, it is crucial that the network remain available in the face of worm outbreaks, denial-of-service attacks and other Internet catastrophes.”
Static Analysis of Executables to Detect Malicious Patterns (2003, background): “In a recent outbreak, the Sapphire/SQL Slammer worm reached the peak infection rate in about 10 minutes since launch, doubling every 8.5 seconds [ 31 ].”
Automated Worm Fingerprinting (2004, background): “Moore et al. subsequently analyzed the Slammer outbreak and estimated that almost all of the Internet address space was scanned by the worm in under 10 minutes (cid:150) limited only by bandwidth constraints at the infected sites [21].”