Cooperative response strategies for large scale attack mitigation

We introduce models for cooperative mitigating response strategies to suppress large scale Internet worm attack. In our models, cooperating members communicate with others using a "friend protocol" that spreads attack reports to potentially vulnerable uninfected sites. We use mathematical models for the simplest strategies and a simulation for more complex models of mitigation. We investigate the performance of different strategies both in the presence of large scale worms and of false alarms.