Internet worms represent a colossal threat: both to the information-driven economy and to individual home computer users alike. In recent years, a series of worms has successfully spread to infect vast numbers of Internet-connected computers. Worms can cause damage many ways: by overloading a server or network with worm-generated traffic; by causing service unavailability during cleanup, to eliminate a worm from infected machines; and even by incorporating malicious code, that destroys data on an infected machine.
In the Autograph project at Intel Research Pittsburgh (IRP), in collaboration with graduate students and a faculty member at Carnegie Mellon University, they have created a novel software system that studies passing network traffic, identifies worms within that traffic mix, and produces signatures for those worms, all without human intervention. Autograph is running today 24/7 as a research prototype system at IRP, and at several other early-adopter sites around the world. The Autograph team is pleased to announce the public, open-source release of the Autograph software for use by all, in the spirit of the open, collaborative research model pursued in Intel Research’s university labs.
