IBM's Billy Goat Squashes Worms

← Back to Stories (view on slashdot.org)

IBM's Billy Goat Squashes Worms

Posted by Hemos on Monday September 1, 2003 @01:02AM from the behavior-based-activity dept.

fr0z writes "InformationWeek is running a story on "Billy Goat", a novel worm-squashing software developed by researchers in Zurich, Switzerland. IBM says it wants to turn Billy Goat into a product to help guard against computer-network attacks such as those that slowed Internet traffic earlier this month."

12 of 170 comments (clear)

Billy Goat by shird · 2003-09-01 01:06 · Score: 5, Funny

This is a play on the name "Bill Gates", surely? Why else would they call it that. Interesting concept nonetheless.

--
I.O.U One Sig.
"earlier this month" by mirko · 2003-09-01 01:06 · Score: 5, Funny

I do not want to look anal but I think the submitter meant "last month" :-)

--
Trolling using another account since 2005.
1. Re:"earlier this month" by F452 · 2003-09-01 01:36 · Score: 5, Funny
  
  I do not want to look anal but I think the submitter meant "last month" :-)
  Eeyu! Look anal? I can see being anal, or sounding anal, but I'd hate to look anal!
What's the point? by mOoZik · 2003-09-01 01:07 · Score: 5, Insightful

Detecting potential attacks is one thing and preventing damage and slow-down of the internet is another. Even now we can somewhat predict them before they begin to slow the entire net down. But seeing how something akin to these last two worms will slip right by even with our knowledge, this technology becomes rather redundant. Eventually, educating the end-user will be a greater force than some goat.

P.S. any coincidence it is named "Billy"?

--
A blog like any other.
A computer system to seek out worms? by zippity8 · 2003-09-01 01:07 · Score: 5, Funny

So you're turning on a computer system thats intended to be intelligent enough to seek out and erradicate computer worms?

Did you NOT see Terminator 3?

- Those that do not learn from history are doomed to repeat it.

Or, in this case, those that don't learn from crappy movies. =P
Interesting technique by farnz · 2003-09-01 01:08 · Score: 5, Insightful

It sounds like a nice extension of egress filtering; you know which of your IPs are unassigned, and so you assume that boxes trying to access unused IPs are up to no good, and act accordingly (firewall the affected box off, and investigate). Slows worm propagation, and discourages people from scanning your entire address space unnecessarily.

--
I appear to have a blog. Odd.
As in "Billy Goat Gruff"? by Black+Parrot · 2003-09-01 01:12 · Score: 5, Funny

Will it butt trolls off the net too?

--
Sheesh, evil *and* a jerk. -- Jade
Re:inapproporiate title? by farnz · 2003-09-01 01:15 · Score: 5, Informative

Something like Blaster scans the network for vunerable machines; some of these IPs are unassigned. Billy Goat detects the attempts to access unassigned IPs, and alerts admins/firewalls your box off/generally makes noise.
The result is that something like Blaster gets caught before your whole network is infested; Billy Goat ignores a slashdotting, since all the traffic goes to assigned IPs.

--
I appear to have a blog. Odd.
Slashdot Rule #1 by imadork · 2003-09-01 01:16 · Score: 5, Funny

Never click on a link with the word "goat" in it.
Dumb Name by Kaz+Riprock · 2003-09-01 01:26 · Score: 5, Funny

If you built a software package that catches worms...why wouldn't you call it "Early Bird"?

--
Mordor...a magical, mythical land where women are more rare than dragons--but where every man would rather find a dragon
Comment removed by account_deleted · 2003-09-01 01:33 · Score: 5, Interesting

Comment removed based on user account deletion
LaBrea by MoogMan · 2003-09-01 01:58 · Score: 5, Informative

LaBrea - the "Sticky Tarpit". Seems like the same concept, and has a working, free implementation at http://labrea.sourceforge.net/