MULTI-AGENT SYSTEM FOR WORM DETECTION AND CONTAINMENT IN METROPOLITAN AREA NETWORKS

Active worms can cause widespread damages at so high a speed that effectively precludes human-directed reaction, and patches for the worms are always available after the damages have been caused, which has elevated them self to a first-class security threat to Metropolitan Area Networks (MAN). Multi-agent system for Worm Detection and Containment in MAN (MWDCM) is presented to provide a first-class automatic reaction mechanism that automatically applies containment strategies to block the propagation of the worms and to protect MAN against worm scan that wastes a lot of network bandwidth and crashes the routers. Its user agent is used to detect the known worms. Worm detection agent and worm detection correlation agent use two-stage based decision method to detect unknown worms. They adaptively study the accessing in the whole network and dynamically change the working parameters to detect the unknown worms. MWDCM confines worm infection within a macro-cell or a micro-cell of the metropolitan area networks, the rest of the accesses and hosts continue functioning without disruption. MWDCM integrates Worm Detection System (WDS) and network management system. Reaction measures can be taken by using Simple Network Management Protocol (SNMP) interface to control broadband access server as soon as the WDS detect the active worm. MWDCM is very effective in blocking random scanning worms. Simulation results indicate that high worm infection rate of epidemics can be avoided to a degree by MWDCM blocking the propagation of the worms.

An Immunization Strategy for Social Network Worms Based on Network Vertex Influence

Along with the rapid development of social networks, social network worms have constituted one of the major internet security problems. The root of worm is the inevitable software vulnerability during the design and implementation process of software. So it is hard to completely avoid worms in the existing software engineering systems. Due to lots of bandwidth consumption, the patch cannot be transmitted simultaneously by the network administrator to all hosts. This paper studies how to prevent the propagation of social network worms through the immunization of key nodes. Unlike existing containment models for worm propagation, a novel immunization strategy is proposed based on network vertex influence. The strategy selects the critical vertices in the whole network. Then the immunization is applied on the selected vertices to achieve the maximal effect of worm containment with minimal cost. Different algorithms are implemented to select vertices. Simulation experiments are presented to analyze and evaluate the performance of different algorithms.

Instant Messaging Worms Propagation Simulation and Countermeasures

Instant messaging （IM） has become one of the most popular online communication tools among consumer and enterprise IM users. It provides instant message delivery, as well as convenient file transfer services. The increasing popularity and functionalities of IM programs have made it increasingly attractive for attackers, especially for worm writers. IM contact list offers worm an easy way of finding potential victims so that the worm could achieve a surprising spreading speed. This paper first presents our experimental results of simulating IM worm propagation in the logical network defined by IM contact lists, which is reported to be a scale-free network. Then, the existing proposals for detecting and containing IM worm epidemics are discussed. At last, a new algorithm for this purpose is presented, which is based on the observation of the bi-directional nature of IM worm traffic, and its advantages and possible improvements in implementation are analyzed. The simulation results show the proposed algorithm is of significant effect on restricting IM worm propagation.