The Case for Hard-LANs

Network worms-self-propagating network programs-represent a substantial threat to our network infrastructure. Due to the propagation speed of worms, reactive defenses need to be automatic. It is important to understand where and how these defenses need tu fit in the network so that they cannot he easily evaded. As there are several mechanisms malcode authors can use to bypass existing perimeter-centric defenses, this position paper argues that substantial defenses will need to be embedded in the local area network, thus creating “Hard-LANs” designed to detect and respond to worm infections. When compared with conventional network intrusion detection systems (NIDSs), we believe that Hard-LAN devices will need tu have two orders of magnitude better costJperformance, and at least two orders of magnitude better accuracy, resulting in substantial design challenges.