Containment of worms

• US 20060021054A1
• Filed: 03/30/2005
• Published: 01/26/2006
• Est. Priority Date: 07/21/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Costa, Manuel, Castro, Miguel, Rowstron, Antony, Crowcroft, Jon
• Granted Patent: US 7,603,715 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

One aspect of the invention is a vulnerability detection mechanism that can detect a large class of attacks through dynamic dataflow analysis. Another aspect of the invention includes self-certifying alerts as the basis for safely sharing knowledge about worms. Another aspect of the invention is a resilient and self-organizing protocol to propagate alerts to all non-infected nodes in a timely fashion, even when under active attack during a worm outbreak. Another aspect of the invention is a system architecture that enables a large number of mutually untrusting computers to collaborate in the task of stopping a previously unknown worm, even when the worm is spreading rapidly and exploiting unknown vulnerabilities in popular software packages.

Claims

1. One or more computer readable media containing computer readable instructions that, when implemented, perform a method comprising:

a) receiving an instruction to write or store received information in a first portion of a memory of a computing system;

b) associating a first dirty indicator with the first portion of the memory, the first dirty indicator indicating ‘

dirty’

if the received information is received from an untrusted source or from a fourth portion of the memory with a fourth dirty indicator indicating ‘

dirty’

;

c) receiving an instruction to load the received information into a program counter or to execute the received information; and

d) providing an indication of a program vulnerability if the first dirty indicator indicates ‘

dirty’

.

2. The computer readable media of claim 1, wherein the received instruction to load or execute received information includes one or more instructions to move data, one or more arithmetic and logic instructions, or one or more instructions that change a control flow of a program.

3. The computer readable media of claim 1, wherein providing an indication of a program vulnerability includes generating a patch or filter based on the received information.

4. The computer readable media of claim 1, wherein providing an indication of a program vulnerability includes sending a self-certifying alert to at least one other node.

5. The computer readable media of claim 4, further comprising retrieving a node identifier identifying the at least one other node from at least one of a leaf set and a routing table a set of neighbors in an overlay network.

6. The computer readable media of claim 1, further comprising associating an input event identifier with the first portion of memory, the input event identifier identifying a source of the received information.

7. The computer readable media of claim 6, wherein the first dirty indicator includes the input event identifier.

8. The computer readable media of claim 7, further comprising calculating a new data from the received information, storing the new data in a second portion of the memory, and associating a second dirty indicator with the second portion of the memory, the second dirty indicator indicating ‘

dirty’

if the received information is received from the untrusted source or from the fourth memory portion with the fourth dirty indicator indicating ‘

dirty’

.

9. The computer readable media of claim 8, wherein the second dirty indicator includes a first data flow graph indicating at least one step of calculating the new data from the received information or a second data flow graph in the fourth dirty indicator.

10. The computer readable media of claim 1, wherein the first portion of the memory includes at least one of a group consisting of a CPU register, a memory page, and a memory location in the page.

11. The computer readable media of claim 10, wherein the first portion of the memory includes a memory location, the memory location being a portion of a first memory page, the method further comprising associating a page dirty indicator with the memory page based on the first dirty indicator.

12. The computer readable media of claim 1, wherein receiving an instruction to load the received information into a program counter or to execute the received information includes receiving an instruction to execute the received information, if the first dirty indicator does not indicate ‘

dirty’

, then examine a third dirty indicator associated with a third portion of the memory storing an instruction referenced by the received information.

13. The computer readable media of claim 12, further comprising providing an indication of a program vulnerability if the third dirty indicator indicates ‘

dirty’

.

14. A method comprising:

a) maintaining at least one contamination data store which tracks whether a source of a stored value is an untrusted source or a trusted source;

b) before loading the stored value into a program pointer, examining the at least one contamination store;

c) if the at least one contamination data store indicates that the stored value is from a trusted source, loading the stored value;

d) if the at least one contamination data store indicates that the stored value is from an untrusted source, refusing to automatically load the stored value; and

e) in response to refusing to automatically load the stored value, determining a storage location of the stored value and determining an input source of the stored value from the at least one contamination data store.

15. The method of claim 14, wherein the at least one contamination data store includes a data flow graph indicating a set of steps used to calculated calculate the stored value.

16. The method of claim 15, wherein determining an input source includes determining an input source and an offset within the input source of the stored value.

17. The method of claim 14, further comprising if the at least one contamination data store indicates that the stored value is from a trusted source, determining if an instruction pointed to by the stored value is from a trusted source;

and executing the instruction only if the stored value and the instruction are both from at least one trusted source.

18. One or more computer readable media containing computer executable components comprising:

a) means for detecting a worm attack using dynamic data flow analysis;

b) means for generating an alert, in response to a detection of a worm attack;

c) means for distributing the alert, in response to generation of the alert.

19. The computer readable media of claim 18, further comprising means for generating a patch or filter based on the dynamic data flow analysis of the means for detecting.

20. The computer readable media of claim 18, wherein the means for generating an alert includes means for generating a self-certifying alert based at least in part on the dynamic data flow analysis of the means for detecting.