Project looks at ways to hunt worms
Connecting state and local government leaders
The announcement last month by United Kingdom officials that Trojan horse worms have been selectively targeting government networks was an unwelcome'though expected'development, according to computer security experts.
The announcement last month by United Kingdom officials that Trojan horse worms have been selectively targeting government networks was an unwelcome'though expected'development, according to computer security experts.In fact, the Defense Advanced Research Projects Agency has been funding research into a new potential line of network defense'called dynamic quarantining'that could help against the most pernicious kinds of worms.The attack scenario that worries experts such as those at the SANS Institute in Bethesda, Md., is the possibility that a hacker somewhere will create a 'zero-day worm,' a worm that has never been seen before and that ex- ploits a previously unknown network vulnerability.'There are no good alternatives to zero-day worms,' said Jo-hannes Ullrich, chief research officer of the Internet Storm Center, created by the SANS Institute to track Internet attacks.'It comes down to the concept of anomaly detection,' he said. 'You try to identify hosts on the network that generate anomalous traffic. ... Once they're identified, you disconnect the hosts from the network.'The potential for damage to the Internet and the networks that attach to it is immense'the estimated cost of the Code Red worm in July 2001 was more than $2.6 billion, according to Computer Economics magazine.The danger to the military is even higher, as Defense Department officials pursue a strategy to network warfighters on the battlefield.Tony Tether, the director of DARPA, testified about the risk earlier this year before the House Armed Services Terrorism, Unconventional Threats and Capabilities Subcommittee.'[T]he threat to military networks from computer worms... has exceeded current network defense capabilities to mount an adequate defense,' Tether told the subcommittee.To address the threat, the agency started the Dynamic Quarantine of Worms program to develop an integrated system of detection and response devices to quarantine zero-day worms and prevent them from spreading before other parts of a network are infected, he said. The challenge is to be able to identify a worm that does not have a known signature.The work actually began about 18 months ago, when DARPA made a number of awards to companies to conduct research into DQW.Skaion Corp. of North Chelmsford, Mass., received an award, for instance, to provide the infrastructure to conduct live tests under simulated real-world conditions.'We've been simulating realistic traffic that you'd see in a moderate to large-scale network,' said Robert Durst, one of the company's owners. 'With a small number of machines we simulate the activity of hundreds to thousands of computers on a network. [It] includes at least 350 users with their own user characteristics.'DARPA spokeswoman Jan Walker said the DQW program has two phases and is slated to conclude at the end of fiscal 2006.The concept of DQW is well-known. DARPA has funded research on DQW at the University of Massachusetts and the University of California-San Diego.The U-Mass researchers took an approach they called 'assume guilty before proven innocent.' By quarantining a host whenever its behavior looks suspicious, then ending the quarantine shortly thereafter'even if the host has not yet been checked out by security personnel'the spread of a worm is slowed, they found.The prospect of actually stopping a zero-day worm attack is dimmer, according to the UC-SD team.'From our simulation experiments, we conclude that it will be very challenging to build containment systems that prevent widespread infection from worm epidemics,' they concluded. 'In particular we find that for such systems to be successful against realistic worms they must react automatically in a matter of minutes and must interdict nearly all Internet paths.''The problem [in developing DQW] comes down to false positives and false negatives,' Ullrich said. 'You don't want to disconnect somebody for no good reason.'To read the U-Mass paper, go to and enter 445 in the GCN.com/search box. For the UC-SD paper, enter 446.
