Vigilante: end-to-end containment of internet worms

By Manuel Costa, Jon Crowcroft, Miguel Oom Temudo de Castro, Antony Ian Taylor Rowstron, Lidong Zhou, Lintao Zhang, Paul Barham. Symposium on Operating Systems Principles, 2005

539 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/cc9ae5b0b797acbdd901d213e6bbabc91547a6d7

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Raksha: a flexible information flow architecture for software security (2007, methodology): “The generality of the DIFT model has led to the development of several software [4, 14, 5, 28, 13, 18, 15, 21] and hardware [24, 6, 2] implementations.”
All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask) (2010, unknown): “Forward symbolic execution can be used to automatically generate input filters that detect and remove exploits from the input stream [13, 21, 22].”
LIFT: A Low-Overhead Practical Information Flow Tracking System for Detecting Security Attacks (2006, background): “Information flow tracking systems can be implemented in three different ways, including language-based approaches [18, 19, 24, 31, 32], software-only approaches either in binary level [11, 14, 34] or in source level [42], or hardware extensions [17, 36, 39].”
Advanced Allergy Attacks: Does a Corpus Really Help? (2007, background): “, STEM in [9] and taint analysis in [14,3]) to identify attack traffic and to capture information about how the target host processes them.”
Allergy Attack Against Automatic Signature Generation (2006, background): “The filters generated by Vigilante indeed identify inputs that result in dangerous state changes in the destined system and nothing else.”
Securing software by enforcing data-flow integrity (2006, background): “There are many proposals to prevent attacks on software, for example, [30, 24, 27, 5, 18, 34, 31, 16, 19, 13, 37].”
DTA++: Dynamic Taint Analysis with Targeted Control-Flow Propagation (2011, background): “DTA works by marking certain inputs to a program as tainted, and then propagating that taint to other values that are computed transitively based on those tainted inputs.”
Panorama: capturing system-wide information flow for malware detection and analysis (2007, background): “Many systems [26, 13, 28, 12, 35] detect exploits by tracking the data from untrusted sources such as the network being misused to alter the control flow.”
Paragraph: Thwarting Signature Learning by Training Maliciously (2006, unknown): “In the case of automatic generation of worm signatures, host monitoring techniques such as dynamic taint analysis [16, 4, 23, 3] can prevent such mislabeling, as they reliably detect whether the sample actually results in software being exploited.”
Baggy Bounds Checking: An Efficient and Backwards-Compatible Defense against Out-of-Bounds Errors (2009, background): “Techniques such as control-ﬂow integrity [20, 1] or taint tracking (e.g. [10, 26, 11, 35]) detect broad classes of errors, but they do not provide general protection from spatial memory errors.”
Limits of Learning-based Signature Generation with Adversaries (2008, background): “These results hold when there is a valid signature of invariants, the signature-generator uses randomized algorithms, whose output the adversary cannot predict, and even if host-monitoring techniques like taint analysis [7,11,27,30] are used to identify exactly which packets are exploits and which a”
Polyglot: automatic extraction of protocol message format using dynamic binary analysis (2007, methodology): “Name: Variable [14] Message Type: Fixed”
Automated Whitebox Fuzz Testing (2008, background): “Symbolic execution has also been proposed in the context of generating vulnerability signatures, either statically [5] or dynamically [9].”
BitBlaze: A New Approach to Computer Security via Binary Analysis (2008, methodology): “For example, previous approaches either operate on a single process only [17,35,38], or they cannot deal with memory swapping and disks [16, 18].”