Prevent Worm Spreading

Huagang XIE (xie at lids dot org, http://www.lids.org)

1. Introduction

• 1.1 Worm definition
• 1.2 Worm's behaviors
• 1.3 3-tier to prevent worm spreading

2. LIDS prevent worm spreading

• 2.1 What is LIDS
• 2.2 Socket Restriction
• 2.3 Packet label and Netfilter control

3. Implementation

• 3.1 Data Structure for Socket
• 3.2 socket operation restriction.
• 3.3 Packet Label and Netfilter

4. Examples

• 4.1 Prevent http worm.
• 4.2 Prevent ftp worm
• 4.3 Prevent pop3 worm
• 4.4 Restrict ssh and telnet user connection.
• 4.5 Prevent backdoor install on sendmail

5. Summary

6. Acknowledgment

7. Reference