Using predators to combat worms and viruses: a simulation-based study

Abstract

Large-scale attacks generated by fast-spreading or stealthy malicious mobile code, such as flash worms and e-mail viruses, demand new approaches to patch management and disinfection. Currently popular centralized approaches suffer from distribution bottlenecks which cannot be solved by merely increasing the number of servers, as the number of servers required to eliminate all bottlenecks is impractically large. Recently, predators were proposed as a technique for eliminating automated mobile malware from computer networks. Predators are benevolent, self-propagating mobile programs which have the ability to clean up systems infected by malignant worms/viruses. We propose a number of extensions to the original predator model, including immunizing predators, persistent predators, and seeking predators. We report on a set of simulations which explore the effects of predators on small-scale (800 to 1600 node) networks. Our results indicate that predators hold significant promise as an alternative to the centralized patch distribution mechanism. The results show that predators can be used to disinfect systems and distribute patches rapidly across the network, without suffering from bottlenecks or causing network congestion. The results also show that the new predator models provide significant benefits over the original predator model. The simulation tool is also useful for tuning predator behavior, so that an optimal tradeoff between the peak virus/worm infection rate and the overhead generated by the predator can be chosen before a predator is released.

Pervasive Malware Propagation Mechanism and Mitigation Techniques

“…To model the spread of malware we will make use of similar paradigms of Lotka-Volterra equations [2] but design it a little differently to reflect the nature of malware proliferation. Specifically, simply using our knowledge of how malware can spread by exploiting certain set of known and unknown vulnerabilities to design equations that allow us to model and analyze the dynamics of its proliferation [3] [5].…”

“…Using the Lotka-Volterra equations from biomathematics [2] to depict the malware [8][9] propagation model:…”

“…Targeting specific set of different vulnerabilities in the three different applications as mentioned above, to show & demonstrate how exactly a malware propagates itself by exploiting any vulnerability across the network for any particular target application. Based on the limitations & dependencies of the particular malwares targeting these kind of vulnerabilities and statistically will try to model a mathematical equation for the spread mechanism of malware modeling based on the Lotka-Volterra equations [2], which are widely used for modeling population dynamics of species competing for the same resources. Based on our analysis the success rate and failure rates for the malware have been set based on our calculated parameters.…”

“…Based on our analysis the success rate and failure rates for the malware have been set based on our calculated parameters. Since our focus is on the propagation mechanisms of a malware modeling based on Lotka-Volterra equations [2], following assumptions are applied for this implementation model:…”

"Good" worms and human rights

“…• Predator worms are revisited periodically, the somewhat romantic notion that good worms can hunt down and destroy bad worms, or that good worms can find and patch vulnerable machines [1, 10,30]. Real attempts at predator worms, such as the Welchia worm which tried to clean up after Blaster [24], have generally proven disastrous and have resulted in more trouble than the original worm caused.…”