Worms Containment Strategy

Computer worms -- malicious, self-propagating programs -- represent a significant threat to large networks. The worm’s spread can be controlled by dividing it into a small subsection of the network, called as containment [2]. The containment suitable for deployment in high-speed, low-cost network hardware has been developed in this work. A branching process model for characterizing the propagation of internet worms is illustrated. Also, methods to stop the scanning of a host have been shown. The model is developed for uniform scanning worms. This leads to the development of an automatic worm containment strategy that prevents the spread of the worm beyond its early stage. Particularly, whether or not the distribution of the total number of infected hosts needs to be prevented by imposing a condition on the worm spread. The priority scanning of worms is developed by lowering the number of scans to dark-address space. The lower bound of the algorithm is determined by our analysis, which is carried out through validations governed by simulations and real time data.