Trip Report: Worm05

Friday I went to The 3rd Workshop on Rapid Malcode (WORM) and heard some of the latest in worm-related research. I'll be focusing on some of the papers in the coming days and weeks, but two of the invited talks were quite interesting.

The first one of note was Invited talk: Scalable Internet Threat Monitoring by Stefan Savage (UCSD). He talked about two of the major research projects he's been involved in, the Ptomkin honeyfarm and Autograph. Both are large scale worm detection and characterization techniques. The honeyfarm project represents a major step forward in detecting worms using honeypots. The methods used in the project allow for massive amounts of stacking of guest systems on a single host, well beyond the limits possible in previous projects like iSink. Autograph, in turn, had been commercialized by Netsift (since acquired by Cisco). Again, scalability and fidelity beyond the levels which most other groups had been able to achieve before. Think "Honeycomb" on steroids.

The other invited talk of note was An Analysis of the Witty Outbreak: Exploiting Underlying Structure for Detailed Reconstructions of an Internet-scale Event by Vern Paxson (ICSI). What Paxson and his colleagues had been able to do was to take a large amount of data they had gathered on the Witty worm and, knowing how the worm generated its random target addresses and how the random function worked, they were able to do a number of things. They could reconstruct the number of infected hosts, how often they hit the disk with a piece of random damage, their uptime, and the initial site that was infected. All in all, a very impressive piece of work.