Design, implementation and test of an email virus throttle

Abstract

virus throttle, email virusThis paper presents an approach to preventing the damage caused by viruses that travel via email. The approach prevents an infected machine spreading the virus further. This directly addresses the two ways that viruses cause damage: less machines spreading the virus will reduce the number of machines infected and reduce the traffic generated by the virus. The approach relies on the observation that normal emailing behaviour is quite different from the behaviour of a spreading virus, with the virus sending messages at a much higher rate, to different addresses. To limit propagation a rate-limiter or virus throttle is described that does not affect normal traffic, but quickly slows and stops viral traffic. The paper includes an analysis of normal emailing behaviour, and details of the throttle design. In addition an implementation is described and tested with real viruses, showing that the approach is practical. AbstractThis paper presents an approach to preventing the damage caused by viruses that travel via email. The approach prevents an infected machine spreading the virus further. This directly addresses the two ways that viruses cause damage: less machines spreading the virus will reduce the number of machines infected and reduce the traffic generated by the virus.The approach relies on the observation that normal emailing behaviour is quite different from the behaviour of a spreading virus, with the virus sending messages at a much higher rate, to different addresses. To limit propagation a rate-limiter or virus throttle is described that does not affect normal traffic, but quickly slows and stops viral traffic. The paper includes an analysis of normal emailing behaviour, and details of the throttle design. In addition an implementation is described and tested with real viruses, showing that the approach is practical.

Development Model of Email Virus Based on Abnormity Detection

“…The normal emailing behaviors is quite different from the behaviors of a viral email which send emails to different destinations with a much high rate [4] . This phenomenon violated the normal behavior of email users.…”

Thwarting E-mail Spam Laundering

“…Most delaying mechanisms, such as tarpitting [Hunter et al 2003], throttling [Williamson 2003;Woolridge et al 2004], and TCP Damping [Li et al 2004] E-mail address-based filters: There are a variety of e-mail address-based filters with different complexity. Among them, the traditional whitelists and blacklists are the simplest.…”

Towards Blocking Outgoing Malicious Impostor Emails

“…This has actually been confirmed by our preliminary simulation study showed in Section 3. As a consequence, existing epidemic models of, and countermeasures against, email worms (e.g., [5,8]) are not applicable. The simulation-based study of email worms [9] is different from ours, because the former considers a network consisting of only end users, whereas we consider a network consisting of both end users and email servers.…”

“…Such emails look perfectly legitimate, except their attachments, when "double-clicked," could infect the victim's machine and further spread by themselves. Compared with traditional email worms, they could adopt more sophisticated and crafty spreading strategies other than, e.g., a simple-minded fast-spreading that may be easily detected and contained [8]. Moreover, malicious impostor emails may be sent by an adversary that has compromised a legiti- * Supported in part by UTSA CIAS.…”