Analysis of the Worm Interaction：该蠕虫的交互分析.pptVIP

On the Performance Evaluation of Encounter-based Worm Interactions Based on Node Characteristics Sapon Tanachaiwiwat* and Ahmed Helmy** *Ming Hsieh Department of Electrical Engineering University of Southern California tanachai@ **Computer and Information Science and Engineering University of Florida helmy@ Motivation More worms targeting mobile devices especially exposed Bluetooth-enabled phones e.g. Cabir, CommWarior, Mabir,… Centralized approach like Firewall is inapplicable in such networks Need decentralized approach We propose “Worm Interaction” Approach Goal Model more realistic worm propagation and interactions Most of work assumes fully cooperation, all susceptible and always ON Our model focus on effects of cooperation, immunization, and on-off behavior on worm interaction in encounter-based networks Related work Disease spread modeling: SI, SIS,SIR, SEIR (S=Susceptible, I=Infected, R=Recovered, and E= Exposed) Worm propagation models motivated by above models Automated security countermeasure Epidemic routings in delay tolerant networks Definitions Encounter-based networks Delay-tolerant networks Store-and-forward Rely on human encounter pattern Worms in encounter-based networks = encounter-based worms Prey = Bad worm, Predator = Good worm Predator (Good worm) terminates Prey (bad worm) Worm Interaction Types Basic assumptions Uniform encounter Both predators (good worm) and prey (bad worm) shares the same susceptible nodes Human encounter pattern does not change over time Simulation setup: Monte-Carlo Encounter-level simulation, 1000 nodes, 1000 rounds of experiment Metrics Total prey infected hosts (TI) Maximum prey infected hosts (MI) Total prey lifespan (TL) Individual prey lifespan (AL) Time to secure all hosts (TA) Time to remove all prey (TR) Relationships of Metrics with Host Ratio Node Characteristics Cooperation Immunization On-off behavior Batch-Arrival Aggressive One-sided with Node Characteristics Effect of Cooperation and Immunizat