North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: The Internet's Immune System
Christopher X. Candreva wrote: So in the above example, if I receive the report for 192.168.1.1 being anThat's a start, but think about this. Worms are fast now. [1] Lets say you have 30 seconds to stop a worm from the time it hits the internet to until the time it's fully propagated to the point of serious network disruption. Automated techniques are the only thing that will stop it but is your idea "fast enough?" I don't think so. Relying on user reports is good for compromises and spambots but it won't do anything to stop CodeRed or Nimda. Paul's use of the word immune system hit it on the head. An immune systemIt has to automatically fight it, it has to be accurate and it has to be fast. I don't think anything comes close to that today. -davidu [1]: http://www.cs.berkeley.edu/~nweaver/cdc.web/ ---------------------------------------------------- David A. Ulevitch - Founder, EveryDNS.Net Washington University in St. Louis http://david.ulevitch.com -- http://everydns.net ----------------------------------------------------
|