NIS08-6: Defending against Instant Messaging Worms

Due to the real time nature and buddy list presence information of instant messaging (IM) systems worms can spread over IM networks rapidly, causing severe damages, however, it is a challenge to detect and control their propagation; it has become an urgent task to develop and deploy efficient procedures to proactively defend against worms before they plague IM networks. Based on modeling and analysis of worm propagation and traffic pattern, we present efficient methods for real time worm detection and control, including content insensitive tracing, signature-based detection, and relay restriction. Experiments on real IM network topologies, such as AIM, have shown promising results of our approaches.