Sweeper: A Lightweight End-ToEnd System For Defending Against Fast Worms

The vulnerabilities that plague computers cause endless grief to users. Slammer compromised millions of hosts in minutes; a hit-list worm would take under a second. Recently pro-posed techniques respond better than manual approaches, but require expensive instrumentation, which limits deploy-ment. Although spreading “antibodies ” (e.g. signatures) ameliorates this limitation, hosts depending on antibodies are defenseless until inoculation; to the fastest hit-list worms this delay is crucial. Additionally, most recently proposed techniques cannot provide recovery to provide continuous service after an attack. We propose a novel solution called Sweeper that provides both fast and accurate post-attack analysis and efficient re-covery with low normal execution overhead. Sweeper in