Dynamic quarantine of internet worms

If we limit the contact rate of worm traffic, can we al-leviate and ultimately contain Internet worms? This paper sets out to answer this question. Specifically, we are inter-ested in analyzing different deployment strategies of rate control mechanisms and the effect thereof on suppressing the spread of worm code. We use both analytical models and simulation experiments. We find that rate control at in-dividual hosts or edge routers yields a slowdown that is lin-ear in the number of hosts (or routers) with the rate lim-iting filters. Limiting contact rate at the backbone routers, however, is substantially more effective—it renders a slow-down comparable to deploying rate limiting filters at every individual host that is covered. This result holds true even when susceptible and infected hosts are patched and immu-nized dynamically. To provide context for our analysis, we examine real traffic traces obtained from a campus comput-ing network. We observe that rate throttling could be en-forced with minimal impact on legitimate communications. Two worms observed in the traces, however, would be sig-nificantly slowed down. 1