Defending against Internet worm-like infestations

The easy access and wide usage of the Internet make it more convenient for technical research and information exchange. However, malicious codes, such as Code Red, Nimda, SQL Slammer and W32/Blaster, also occur more frequently and severely than ever. These self-propagating malicious codes can invade network and paralyze normal network operation. These Internet worms could, in a very short time, cause great damage to network and information infrastructure. Therefore, Internet worms have become vital threats to network and security management. In this paper, we present a proactive responding scheme to deal with Internet worms. Based on this scheme, we designed and implemented a pro-active defending system against Internet worms. This proactive defending system will monitor network traffic, detect hosts with abnormal network behavior and isolate these hosts from the managed network. The results show that it can efficiently mitigate the impact caused by Internet worms and stop the wide-spreading of Internet worms.