Earlier this week, researchers at Penn State University issued a report about a new software system they say can better defend against Internet worm viruses.
And while much more attention is being given of late to spyware programs responsible for stealing real world assets from both businesses and consumers, the recent ripple caused by the Storm Worm attack proved the approach still has potency.
Researchers at messaging security software maker Commtouch estimated that more than 7,000 distinct variants of Storm Worm appeared over the first few days of its mid-January outbreak, with more than 40,000 variants identified by the company as of Feb. 1.
The Penn State group claims to improve on existing signature-based and pattern-based worm defense systems with a technology dubbed PWC (Proactive Worm Containment).
Unlike the more traditional worm identification and blocking tools, the researchers claim their anti-virus system monitors a packet’s rate or frequency of connections — and the diversity of its connections to other networks — to speed response to potential outbreaks, according to a report filed on the University’s Penn State Live site.
Just as most experts say signature-based anti-virus tools are insufficient to stop zero days threats and other more cutting-edge attacks on the network and desktops, organizations need a more proactive approach to faster moving worm threats to ward them off effectively, the PSU researchers said.
“A lot of worms need to spread quickly in order to do the most damage, so our software looks for anomalies in the rate and diversity of connection requests going out of hosts,” Peng Liu, an associate professor at Penn State and lead researcher on the PWC system, is quoted as saying in the report.
The defense mechanism involved controls the flow of packet outbreaks and more aggressively quarantines suspicious traffic, while employing intelligent false-positive prevention tools, according to the researchers. In that manner the PWC is also better suited to defend against denial-of-service attacks, the group claims.
One shortcoming of the system admitted by its inventors is an ability to capture slow-spreading worms. However, your old school signature-based system should be able to catch those, said Liu and his group.