Gesellschaft fr Informatik e.V.

Lecture Notes in Informatics


Detection of Intrusions and Malware & Vulnerability Assessment, GI SIG SIDAR Workshop, DIMVA 2004, Dortmund, Germany, July 6.7, 2004 P-46, 187-200 (2004).

GI, Gesellschaft für Informatik, Bonn
2004


Editors

Ulrich Flegel, Michael Meier (eds.)


Copyright © GI, Gesellschaft für Informatik, Bonn

Contents

LIV - the linux integrated viruswall

Teobaldo A. Dantas De Medeiros and Paulo S. Motta Pires

Abstract


This paper presents a system developed in Linux aiming the protection of local area networks containing Windows workstations against malicious agents. The developed solution, named LIV - Linux Integrated Viruswall, besides filtering SMTP, HTTP and FTP traffic destined to the protected network, is capable of detecting malicious agents propagation in the local area network using a technique that we call "sharing-trap". Compromised workstations are isolated from the network and their users are notified, stopping the malicious agent's spread. Results collected from a network protected by LIV, containing thousands of Windows workstations, are presented and discussed. This paper includes information about the recent incident caused by MyDoom worm.


Full Text: PDF

GI, Gesellschaft für Informatik, Bonn
ISBN 3-88579-375-X


Last changed 24.01.2012 21:45:59