Worm Propagation Modeling and Analysis under Dynamic Quarantine …

Short Description
sis shows that the dynamic quarantine can reduce a worm’s. propagation speed, which can give us …. analyze a worm’s propagation under such dynamic quaran- …

Website: tennis.ecs.umass.edu | Filesize: 253kb

Content
Worm Propagation Modeling and Analysis
under Dynamic Quarantine Defense
Cliff Changchun Zou
Dept. Electrical &
Computer Engineering
Univ. Massachusetts
Amherst, MA
czou@ecs.umass.edu
Weibo Gong
Dept. Electrical &
Computer Engineering
Univ. Massachusetts
Amherst, MA
gong@ecs.umass.edu
Don Towsley
Dept. Computer Science
Univ. Massachusetts
Amherst, MA
towsley@cs.umass.edu
ABSTRACT
Due to the fast spreading nature and great damage of Internet
worms, it is necessary to implement automatic mitigation,
such as dynamic quarantine, on computer networks.
Enlightened by the methods used in epidemic disease control
in the real world, we present a dynamic quarantine method
based on the principle “assume guilty before proven innocent”
- we quarantine a host whenever its behavior looks
suspicious by blocking traffic on its anomaly port. Then
we will release the quarantine after a short time, even if
the host has not been inspected by security staffs yet. We
present mathematical analysis of three worm propagation
models under this dynamic quarantine method. The analysis
shows that the dynamic quarantine can reduce a worm’s
propagation speed, which can give us precious time to fight
against a worm before it is too late. Furthermore, the dynamic
quarantine will raise a worm’s epidemic…