Models of Active Worm Defenses
نویسندگان
چکیده
The recent proliferation of Internet worms has raised questions about defensive measures. To date most techniques proposed are passive, in-so-far as they attempt to block or slow a worm, or detect and filter it. Active defenses take the battle to the worm—trying to eliminate or isolate infected hosts, and/or automatically and actively patch susceptible but as-yet-uninfected hosts, without the knowledge of the host’s owner. The concept of active defenses raises important legal and ethical questions that may have inhibited consideration for general use in the Internet. However, active defense may have immediate application when confined to dedicated networks owned by an enterprise or government agency. In this paper we model the behavior and effectiveness of different active worm defenses. Using a discrete stochastic model we prove that these approaches can be strongly ordered in terms of their worm-fighting capability. Using a continuous model we consider effectiveness in terms of the number of hosts that are protected from infection, the total network bandwidth consumed by the worms and the defenses, and the peak scanning rate the network endures while the worms and defenses battle. We develop optimality results, and quantitative bounds on defense performance. Our work lays a mathematical foundation for further work in analysis of active worm defense.
منابع مشابه
Models and Analysis of Active Worm Defense
The recent proliferation of Internet worms has raised questions about defensive measures. To date most techniques proposed are passive, in-so-far as they attempt to block or slow a worm, or detect and filter it. Active defenses take the battle to the worm—trying to eliminate or isolate infected hosts, and/or automatically and actively patch susceptible but as-yet-uninfected hosts, without the k...
متن کاملPotential Strategies for High Speed Active Worms: A Worst Case Analysis
Active worms, malicious programs which spread in a completely autonomous manner, have the potential to rapidly spread across the internet. Two important questions which must be answered when constructing defenses is how fast a worm can spread and how long a given worm can remain a significant threat on the Internet, as these answers dictate requirements for defenses. There are multiple obvious ...
متن کاملA Firewall Network System for Worm Defense in Enterprise Networks
From a security point of view, the Internet is too open. The central idea of a traditional “firewall” is to constrain service requests from the Internet to a local network. As an enterprise network becomes larger and more flexible, an Internet worm can easily find a way to enter it. Based on the “defense-in-depth” principle, we present a “Firewall Network System” for worm defense in an enterpri...
متن کاملInternet Epidemics: Attacks, Detection and Defenses, and Trends
Internet epidemics are malicious software that can self-propagate across the Internet, i.e., compromise vulnerable hosts and use them to attack other victims. Since the early stage of the Internet, epidemics have caused enormous damages and been a significant security threat. For example, the Morris worm infected 10% of all hosts in the Internet in 1988; the Code Red worm compromised at least 3...
متن کاملDo brominated natural products defend marine worms from consumers? Some do, most don’t
Worms and other marine invertebrates living in soft sediments commonly produce brominated natural products that have been hypothesized to function as defenses against consumers, but this hypothesis has not been tested directly. When 16 species of worms from a Georgia mud flat were fed to two sympatric fishes (Fundulus heteroclitus, Leiostomus xanthurus) and a crab (Callinectes similis), 15 spec...
متن کامل