DeWorm, Worm monitoring on Internet backbones

DeWorm is aimed at developing an automated response system that is capable of (1) detecting zero-day worms on the Internet, (2) generating signatures for the attacks, and (3) using these signatures to block malicious traffic. The goal is to make it fast enough to react to fast-spreading worms. We do this by means of two tiers. In tier I, traffic on fast links that is considered (somewhat) suspect is steered towards a deep scan node (Tier II) for detailed analysis. The deep scan node analyses the traffic and generates signatures if it finds the traffic malicious. Participating company: TNO ICT