early reaction to worm outbreaks has been commonly accepted as a worthwhile goal in worm defense mechanisms. however, worms typically are growing at an increasing rate in this critical early phase. due to a lack of insght into the propogation mechanism, network and system administrators cannot react quickly enough to make a difference in this early phase.

using vthrottle, a sendmail milter-based plugin, a generic worm propogation limiting mechanism has been developed. this idea is based on the presumption that damaging worms often attempt to spread as quickly as possible. this spread rate typically requires nework activity well above a host's normal rates. by enforcing rates which limit their impact to worm behaviors, the network or network access devices (such as servers) can limit the spread of worms and other malware, giving administrator's time in reacting to the scenario. vthrottle is a simple implementation of an SMTP rate limiting mechanism for sendmail servers.

presentation text: [TXT]