Models and Analysis of Active Worm Defense

Abstract. The recent proliferation of Internet worms has raised questions about defensive measures. To date most techniques proposed are passive, in-so-far as they attempt to block or slow a worm, or detect and filter it. Active defenses take the battle to the worm—trying to eliminate or isolate infected hosts, and/or automatically and actively patch susceptible but as-yet-uninfected hosts, without the knowledge of the host’s owner. The concept of active defenses raises important legal and ethical questions that may have inhibited consideration for general use in the Internet. However, active defense may have immediate application when confined to dedicated networks owned by an enterprise or government agency. In this paper we model the behavior and effectiveness of different active worm defenses. Using a discrete stochastic model we prove that these approaches can be strongly ordered in terms of their wormfighting capability. Using a continuous model we consider effectivenes...

• Type: Conference
• Year: 2005
• Where: MMMACNS
• Authors: David M. Nicol, Michael Liljenstam
• Keywords: Active Defense, Active Worm Defense, Computer Networks, Different Active Worm, MMMACNS 2005