Verme: Worm containment in overlay networks

Abstract

Topological worms, such as those that propagate by following links in an overlay network, have the potential to spread faster than traditional random scanning worms because they have knowledge of a subset of the overlay nodes, and choose these nodes to propagate themselves; and also because they can avoid traditional detection mechanisms. Furthermore, this worm propagation strategy is likely to become prevalent as the deployment of networks with a sparse address space, such as IPv6, makes the traditional random scanning strategy futile.We present a novel approach for containing topological worms based on the fact that some overlay nodes may not have common vulnerabilities, due to their platform diversity. By reorganizing the overlay graph, it is possible to contain topological worms in small islands of nodes with common vulnerabilities that only have knowledge of themselves or nodes running on distinct platforms. We also present the design of Verme, a peer-to-peer overlay based on Chord that follows this approach, and VerDi, a DHT layer built on top of the Verme routing overlay.Simulations show that Verme and VerDi have a low overhead when compared to Chord's corresponding layers, and that our new overlay design helps containing, or at least slowing down the propagation of topological worms.

Proactive P2P worm containment via automatic authentication

“…In recent years, researchers find that increasing configuration diversity is an effective method to quarantine PRWORM (Zhou et al , 2006; McIlwraith et al , 2008; Freitas et al , 2009). This method aims at decreasing homogeneity and breaking monocultures of P2P software.…”

Phagocytes: A Holistic Defense and Protection Against Active P2P Worms

“…Recognizing such threats, many researchers started to study the corresponding defense mechanisms. Specifically, Yu et al in [30] presented a region-based active immunization defense strategy to defend against active P2P worm attacks; Freitas et al in [9] utilized the diversity of participating hosts to design a worm-resistant P2P overlay, Verme, for containing possible P2P worms; moreover, in [29], Xie and Zhu proposed a partition-based scheme to proactively block the possible worm spreading as well as a connected dominating set based scheme to achieve fast patch distribution in a race with the worm, and in [28], Xie et al further designed a P2P patching system through file-sharing mechanisms to internally disseminate security patches. However, existing defense mechanisms generally focused on the internal P2P worm defense without the consideration of external worm attacks, so that they cannot provide a total worm protection for the P2P overlay systems.…”

Concept, Characteristics and Defending Mechanism of Worms

“…Since most worms can not run on multiple platforms, we can design a special topology to isolate worms, where peers running on the same platform are not connected. A protocol, called Verme, is designed in [41], which is an extension of Chord. In Verme, all the peers are divided into different groups, called islands, according to the type of vulnerabilities.…”