COVERAGE: detecting and reacting to worm epidemics using cooperation and validation

• Published in: International journal of information security Vol. 6; no. 6; pp. 361 - 378
• Main Authors: Anagnostakis, Kostas G., Greenwald, Michael B., Ioannidis, Sotiris, Keromytis, Angelos D.
• Format: Journal Article
• Language: English
• Published: Heidelberg Springer Nature B.V 01.10.2007
• Subjects: Alarms; Algorithms; Communication; Computer viruses; Cooperation; Costs; Cybercrime; Cybersecurity; Epidemics; False alarms; Immunization; Infections; Propagation; Sensors; Studies; Viruses; Worms
• ISSN: 1615-5262; 1615-5270
• DOI: 10.1007/s10207-007-0032-z

Cooperative defensive systems communicate and cooperate in their response to worm attacks, but determine the presence of a worm attack solely on local information. Distributed worm detection and immunization systems track suspicious behavior at multiple cooperating nodes to determine whether a worm attack is in progress. Earlier work has shown that cooperative systems can respond quickly to day-zero worms, while distributed detection systems allow detectors to be more conservative (i.e., paranoid) about potential attacks because they manage false alarms efficiently. In this paper we present our investigation into the complex tradeoffs in such systems between communication costs, computation overhead, accuracy of the local tests, estimation of viral virulence, and the fraction of the network infected before the attack crests. We evaluate the effectiveness of different system configurations in various simulations. Our experiments show that distributed algorithms are better able to balance effectiveness against worms and viruses with reduced cost in computation and communication when faced with false alarms. Furthermore, cooperative, distributed systems seem more robust against malicious participants in the immunization system than earlier cooperative but non-distributed approaches. [PUBLICATION ABSTRACT]