A distributed worm confinement strategy based on cost-benefit analysis

Due to the ability of malicious worms to spread quickly over the Internet, detection and reaction mechanisms are needed in order to stop the progress of the infection process. Existing worm thwarting techniques do not take into account the false negative and false positive probabilities when implementing the responses. In this paper, we study the impact of the efficiency of the worm detection process on the selected responses. To this purpose, we develop a cost-benefit model allowing the representation of the impact caused by the worm propagation as well as the outcome of the potential reaction. We show that our approach enables the selection of the convenient security solution, especially with respect to the reaction time, which is not considered by the traditional worm response techniques. The efficiency of the proposed approach is corroborated by practical experiments.