Tracing Worm Break-In and Contaminations via Process Coloring: A Provenance-Preserving Approach

• Published in: IEEE transactions on parallel and distributed systems Vol. 19; no. 7; pp. 890 - 902
• Main Authors: Xuxian Jiang, Buchholz, F., Walters, A., Dongyan Xu, Yi-Min Wang, Spafford, E.H.
• Format: Journal Article
• Language: English
• Published: New York IEEE 01.07.2008; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Collection; Color; Coloring; Computer science; Computer worms; Computerized monitoring; Contamination; Internet; Monitoring; Network servers; Operating systems; Preserves; Remote monitoring; Security and Protection; Servers; Trojan horses; viruses; Web server; Worms; worms; viruses; Security and Protection; Servers; Trojan horses
• ISSN: 1045-9219; 1558-2183
• DOI: 10.1109/TPDS.2007.70765

To detect and investigate self-propagating worm attacks against networked servers, the following capabilities are desirable: 1) raising timely alerts to trigger a worm investigation, 2) determining the break-in point of a worm, i.e., the vulnerable service from which the worm infiltrates the victim, and 3) identifying all contaminations inflicted by the worm during its residence in the victim. In this paper, we argue that the worm break-in provenance information has not been exploited in achieving these capabilities and thus propose process coloring, a new approach that preserves worm break-in provenance information and propagates it along operating- system-level information flows. More specifically, process coloring assigns a "color," a unique systemwide identifier, to each remotely accessible server process. The color will be either inherited by spawned child processes or diffused transitively through process actions. Process coloring achieves three new capabilities: color-based worm warning generation, break-in point identification, and log file partitioning. The virtualization-based implementation enables more tamper-resistant log collection, storage, and real-time monitoring. Beyond the overhead introduced by virtualization, process coloring only incurs very small additional system overhead. Experiments with real-world worms demonstrate the advantages of processing coloring over non-provenance-preserving tools.