Robust Reactions to Potential Day-Zero Worms Through Cooperation and Validation

摘要: Cooperative defensive systems communicate and cooperate in their response to worm attacks, but determine the presence of a attack solely on local information. Distributed detection immunization track suspicious behavior at multiple cooperating nodes whether is progress. Earlier work has shown that cooperative can respond quickly day-zero worms, while distributed allow detectors be more conservative (i.e. paranoid) about potential attacks because they manage false alarms efficiently. In this paper we begin preliminary investigation into complex tradeoffs such between communication costs, computation overhead, accuracy tests, estimation viral virulence, fraction network infected before crests. We evaluate effectiveness different system configurations various simulations. Our experiments show algorithms are better able balance against viruses with reduced cost when faced alarms. Furthermore, cooperative, seem robust malicious participants than earlier non-distributed approaches.