Microsoft Researchers Target Worms, Buffer Overruns

REDMOND, WASHINGTON -- Microsoft researchers showed off some forward-looking technologies this week, including new ways to protect systems against Internet worms, prevent hacker attacks, and measure available bandwidth on home networks.

At its fifth annual TechFest, Microsoft Research presented about 150 projects here at the company's headquarters. The event was expected to attract about 6000 Microsoft employees. Its main purpose is to promote the exchange of ideas, or "tech transfers," between Microsoft Research and product teams at the software maker.

One of the technologies on display, dubbed Vigilante, proposes a detection and protection system for Internet worms. The system would consist of "honey pot" computers connected to the Internet that would serve as bait for the worms. Once an attack was detected, the computers would analyze the attack and create alerts that included details on how to protect against the new threat. The alerts then would be pushed out to other computers, which would automatically put up shields and filter traffic to block the worm, Microsoft researchers said.

Systems receiving the Vigilante alerts would not require any action from an administrator to protect against the worms, said Manuel Costa, a researcher in Microsoft's Cambridge, England, lab. "We need a completely automatic system to detect attacks," he said.

Costa, who was demonstrating a prototype of Vigilante at TechFest, acknowledged that administrators may be apprehensive about automatic changes to their systems, but he said the filters would block only real attack messages. Automatic filters are needed to provide a quick response to worm outbreaks, he said. "Otherwise, it will be too late."

Blocking Malicious Code

Another Microsoft Research project focused on security suggests monitoring system activity to prevent malicious code from executing. The system, called Control-Flow Integrity, would prevent malicious code from being run on a computer by checking application activity and validating it. Unexpected activity would be blocked, according to Microsoft.

The system would prevent attacks that exploit buffer overflows by inserting malicious code, said Roy Levin, director of Microsoft Research Silicon Valley. However, one side effect of monitoring applications is a slower system. "You are getting a stronger guarantee, but in exchange for some performance," Levin said.

Vigilante and Control-Flow Integrity are research projects only, but the researchers said they are drawing interest from Microsoft product teams. However, there has been no commitment from any of the product groups to use the technologies.

Transfer inside Microsoft has happened for Probegap, a Microsoft Research technology that lets users estimate the available bandwidth on, for example, a home network. Probegap is planned as part of the next Windows client release, code-named Longhorn, due in 2006, said Venkata Padmanabhan, a researcher at Microsoft.

Application developers can link to the Probegap API (application programming interface) to check available bandwidth before executing a request, Padmanabhan said. For example, Windows Media Player can alert a user that not enough bandwidth is available to play a high-quality video and instead offer a lower-quality stream, he said.

Media Center OS Hobbled

At TechFest, Padmanabhan demonstrated how lack of bandwidth today can disrupt the use of Windows XP Media Center Edition, a premium version of Windows designed to be an entertainment hub for the home that can connect to other PCs and TVs over a wireless or wired network.

"Today, you can start an additional [video] stream and disrupt existing streams," he said. Windows XP Media Center Edition can handle about three TV-quality streams over a wireless network before running out of bandwidth, he said.

The more than 700 people at Microsoft Research work on projects in more than 50 research areas, including speech recognition, user interface, programming tools and methodologies, operating systems and networking, graphics, natural language processing, machine learning, and mathematical sciences.

To comment on this article and other PCWorld content, visit our Facebook page or our Twitter feed.
Shop Tech Products at Amazon