An Approach against a Computer Worm Attack

Building a realistic model for a network defense system against a worm attack is vital to better understand the effects of a worm attack on network assets and functionality. Traditional epidemic worm modeling does not take into consideration the real network topology or network actual defense measures. In this paper, we reviewed the network defense systems from different perspectives for defining the level of immunity of different parts of the network and ascertaining the real impact of a worm attack on the network. The idea of immunity came from examining and comparing the immune system in the human body to the defense and security measures of computer networks. Then, we developed a novel, realistic model by splitting the network into the highly immune part of the network (HIN) and the partially immune part of the network (PIN) in order to measure the real impact of worm attack on computer network. Next, we evaluated the effectiveness of this model by implementing network defense measurements adopted from the human immune system. Computer simulations show that the infection waves of worms in HIN have minimal impacts compared to those in the PIN. recognizing the payload of the malicious worm. The results showed the effects of implementing anti-worms with respective propagation schemes and the limitation of anti- worms in practical implementations (6). These worm models assume that all hosts in the network have the same probability to become infected by worms, and; therefore, the same level of vulnerability when it comes to worm attack. Consequently, the results will lead to an unrealistic prediction of the infection wave. This paper represents new approaches to modeling a worm attack on a computer network; the study took into consideration the pre-existing conditions in different parts of network topology. We reviewed the network from a network security prospective where different parts of the network have different levels of defense and immunity measures. The idea of immunity came from examining and comparing the immune system in the human body to the defense and security measures of computer networks (13), (14), (15), (16). Then, we developed a novel realistic model by splitting the network into the highly immune part of the network (HIN) and the partially immune part of the network (PIN) in order to measure the real impact of a worm attack on a computer network. Next, we evaluated the effectiveness of this model by implementing network defense measurements adopted from the human immune system. Computer simulations show that the infection waves of worms in HIN have minimal impacts compared to PIN. This paper is organized as follows: section 2 contains a detailed description of the similarity between the human immune system and a computer network defense system. In this section, we defined the human immune system and we adopt the same concept to invent a new definition for computer network immunity. Section 3 summarizes existing epidemic modeling used as tools for modeling worm attacks on computer networks. In section 4, we present the theoretical and the mathematical approaches for our new realistic epidemic worm modeling epidemic model. The last section includes the conclusion and possibilities for future research.