On capturing and containing E-mail worms

Capturing an E-mail worm and containing its propagation as early as possible is desirable in order to provide better protection for the networks and hosts against severe damage that may be caused by the worm. In this paper, we propose a new approach that makes use of the propagating nature of E-mail worms. This approach inserts into each client´s address book a dummy E-mail address that is not used by any registered user of the local domain, such that we can be confident that any E-mail destined to this dummy E-mail address is generated by an E-mail worm. The captured signatures can then be used to construct a user blacklist and a signature blacklist to contain the propagation of this E-mail worm. We also discuss how E-mail worms can attempt to bypass the dummy E-mail address, and propose countermeasures against these attempts. Our prototype implementation shows that this approach is easily deployable and is effective in containing E-mail worms