Detecting and protecting against worm traffic on a network
A method for processing communication traffic includes monitoring the communication traffic that is directed to a group of addresses on a network, and determining respective baseline characteristics of the communication traffic that is directed to each of the addresses in the group. Deviations from the respective baseline characteristics of the communication traffic directed to at least one of the addresses in the group are detected, as an indication that at least some of the communication traffic may be of malicious origin. Responsively to detecting the deviation, the communication traffic that is directed to all of the addresses in the group is filtered so as to remove at least some of the communication traffic that is of the malicious origin.
1. A method for processing communication traffic, comprising:
monitoring the communication traffic on a network so as to detect packets that are indicative of a communication failure in the network that is characteristic of a worm infection;
detecting an increase in a rate of arrival of the packets that are indicative of the communication failure; and
responsively to the increase, filtering the communication traffic so as to remove at least a portion of the communication traffic that is generated by the worm infection.
2. The method according to claim 1 , wherein monitoring the communication traffic comprises detecting Internet Control Message Protocol (ICMP) unreachable packets.
3. The method according to claim 1 , wherein monitoring the communication traffic comprises detecting failures to establish a Transmission Control Protocol (TCP) connection.
4. A method for processing communication traffic, comprising:
monitoring the communication traffic on a network so as to detect ill-formed packets;
making a determination, responsively to the ill-formed packets, that at least a portion of the communication traffic has been generated by a worm infection; and
responsively to the determination, filtering the communication traffic so as to remove at least the portion of the communication traffic that is generated by the worm infection.
5. The method according to claim 4 , wherein the packets comprise a header specifying a communication protocol, and wherein monitoring the communication traffic comprises determining that the packets contain data that are incompatible with the specified communication protocol.
6. The method according to claim 4 , wherein the packets comprise a header specifying a packet length, and wherein monitoring the communication traffic comprises determining that the packets contain an amount of data that is incompatible with the specified packet length.
7. Apparatus for processing communication traffic, comprising a guard device, which is adapted to monitor the communication traffic on a network so as to detect packets that are indicative of a communication failure in the network that is characteristic of a worm infection, to detect an increase in a rate of arrival of the packets that are indicative of the communication failure, and responsively to the increase, to filter the communication traffic so as to remove at least a portion of the communication traffic that is generated by the worm infection.
8. The apparatus according to claim 7 , wherein the guard device is adapted to detect Internet Control Message Protocol (ICMP) unreachable packets as an indication of the communication failure.
9. The apparatus according to claim 7 , wherein the guard device is adapted to detect failures to establish a Transmission Control Protocol (TCP) connection.
10. Apparatus for processing communication traffic, comprising a guard device, which is adapted to monitor the communication traffic on a network so as to detect ill-formed packets, to make a determination, responsively to the ill-formed packets, that at least a portion of the communication traffic has been generated by a worm infection, and responsively to the determination, to filter the communication traffic so as to remove at least the portion of the communication traffic that is generated by the worm infection.
11. The apparatus according to claim 10 , wherein the packets comprise a header specifying a communication protocol, and wherein the guard device is adapted to detect that the packets contain data that are incompatible with the specified communication protocol.
12. The apparatus according to claim 10 , wherein the packets comprise a header specifying a packet length, and wherein the guard device is adapted to detect that the packets contain an amount of data that is incompatible with the specified packet length.
13. A computer software product, comprising a computer-readable medium in which program instructions are stored, which instructions, when read by a computer, cause the computer to monitor the communication traffic on a network so as to detect packets that are indicative of a communication failure in the network that is characteristic of a worm infection, to detect an increase in a rate of arrival of the packets that are indicative of the communication failure, and responsively to the increase, to filter the communication traffic so as to remove at least a portion of the communication traffic that is generated by the worm infection.
14. The product according to claim 13 , wherein the instructions cause the computer to detect Internet Control Message Protocol (ICMP) unreachable packets as an indication of the communication failure.
15. The product according to claim 13 , wherein the instructions cause the computer to detect failures to establish a Transmission Control Protocol (TCP) connection.
16. A computer software product, comprising a computer-readable medium in which program instructions are stored, which instructions, when read by a computer, cause the computer to monitor the communication traffic on a network so as to detect ill-formed packets, to make a determination, responsively to the ill-formed packets, that at least a portion of the communication traffic has been generated by a worm infection, and responsively to the determination, to filter the communication traffic so as to remove at least the portion of the communication traffic that is generated by the worm infection.
17. The product according to claim 16 , wherein the packets comprise a header specifying a communication protocol, and wherein the instructions cause the computer to detect that the packets contain data that are incompatible with the specified communication protocol.
18. The product according to claim 16 , wherein the packets comprise a header specifying a packet length, and wherein the instructions cause the computer to detect that the packets contain an amount of data that is incompatible with the specified packet length.