Very fast containment of scanning worms

摘要: Computer worms - malicious, self-propagating programs represent a significant threat to large networks. One possible defense, containment, seeks limit worm's spread by isolating it in small subsection of the network. In this work we develop containment algorithms suitable for deployment high-speed, low-cost network hardware. We show that these techniques can stop scanning host after fewer than 10 scans with very low false-positive rate. also augment approach devising mechanisms cooperation enable multiple devices more effectively detect and respond an emerging infection. Finally, discuss ways worm attempt bypass general, ours particular.