Internet quarantine: requirements for containing self-propagating code

By David Moore, Colleen Shannon, Geoffrey M. Voelker, Stefan Savage. IEEE INFOCOM 2003. Twenty-second Annual Joint Conference of the IEEE Computer and Communications Societies (IEEE Cat. No.03CH37428), 2003

597 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/7a686dfda53814eaa3dccc8865e5c826219f5068

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Global Intrusion Detection in the DOMINO Overlay System (2004, background): “The inducement for the satellites is a global vantage point that allows for rapid outbreak recognition, dynamic content filtering and application specific source blacklisting to protect their networks in a timely manner.”
Very Fast Containment of Scanning Worms (2004, unknown): “Since these threats can propagate more rapidly than human response [24, 12], automated defenses are critical for detecting and responding to infections [13].”
Learning the Structural Vocabulary of a Network (2017, unknown): “…f r o m h tt p :// d i r e c t. m i t. edu / ne c o / a r t i c l e - pd f/ 29 / 2 / 287 / 990447 / ne c o_ a_ 00924 . pd f b y gue s t on 18 S ep t e m be r 2021 design and evolution (Haldane & May, 2011; Buldyrev, Parshani, Paul, Stanley, & Havlin, 2010; Moore, Shannon, Voelker, & Savage, 2003).”
Shield: vulnerability-driven network filters for preventing known vulnerability exploits (2004, background): “Moore et al [17] further showed that for existing containment systems such as firewalls and content filters to be successful against realistic worms, they must react automatically in a matter of minutes and must interdict nearly all Internet paths.”
Fast Detection of Scanning Worm Infections (2004, background): “Thus, today's worm response proposals focus on automated responses to worms, such as quarantining infected machines [12], automatic generation and installation of patches [16] [17], and reducing the rate at which worms can issue connection requests so that a more carefully constructed response can…”
Towards automatic generation of vulnerability-based signatures (2006, background): “One of the most popular and effective exploit defense mechanisms is signature-based input filtering (also called content-based filtering) [7, 40] .”
Dynamic Taint Analysis for Automatic Detection, Analysis, and SignatureGeneration of Exploits on Commodity Software (2005, methodology): “Content-based filtering is widely used in intrusion detection systems such as Snort [33], Bro [32], and Cisco’s NBAR system [44], and has been shown to be more effective than other mechanisms, such as source-based filtering for worm quarantine [27].”
Modeling Botnet Propagation Using Time Zones (2006, methodology): “Epidemic modeling of viruses was discussed in [KW91], and later in [ MSVS03 , WW03].”
Polymorphic Worm Detection Using Structural Information of Executables (2005, background): “Once malicious traffic flows are identified, a worm has to be contained to prevent further spreading [14].”
Advanced Allergy Attacks: Does a Corpus Really Help? (2007, background): “5 According to [11], if content filtering is deployed under the “top 100 ISPs” scenario, a reaction time of 10 mins is necessary to protect 90% of vulnerable hosts against a”
Anomalous Payload-Based Worm Detection and Signature Generation (2005, unknown): “[13] D.”
Vigilante: end-to-end containment of internet worms (2005, background): “Worm containment must be automatic to have any chance of success because worms spread too fast for humans to respond [27, 42]; for example, the Slammer worm infected more than 90% of vulnerable hosts in 10 minutes [26].”