I've got you covered!
Posted on 12/03/2005 6:46:01 AM PST by Neville72
(via KurzweilAI.net)
A cure for computer viruses that spreads in a viral fashion could immunise the internet, even against pests that travel at lightning speed, a mathematical study reveals.
Most conventional anti-virus programs use "signatures" to identify and block viruses. But experts must first analyse a virus before sending out the fix. This means that rapidly spreading viruses can cause widespread damage before being stopped.
Some researchers have developed artificial "immune systems" that automatically analyse a virus meaning a fix can be sent out more rapidly. In practise, however, computer viruses still tend to spread too quickly.
Now Eran Shir, and colleagues at Tel-Aviv University in Israeli, have applied network theory to the problem, and believe they have come up with a more effective solution.
Part of the problem, the researchers say, is that countermeasures sent from a central server over the same network as the virus it is pursuing will always be playing catch-up.
They propose developing a network of "honeypot" computers, distributed across the internet and dedicated to the task of combating viruses. To a virus, these machines would seem like ordinary vulnerable computers. But the honeypots would attract a virus, analyse it automatically, and then distribute a countermeasure.
Healing hubs But the honeypots would be linked to one another via a dedicated and secure network. This way, once one has captured a virus, all the others will quickly know about the infection immediately. Each honeypot then acts as a hub of healing code which is disseminated to computers connected to it. The countermeasure then spreads out across the broader network.
Simulations show that the larger the network grows, the more efficient this scheme should be. For example, if a network has 50,000 nodes (computers), and just 0.4% of those are honeypots, just 5% of the network will be infected before the immune system halts the virus, assuming the fix works properly. But, a 200-million-node network – with the same proportion of honeypots – should see just 0.001% of machines get infected.
Security measures, such as encryption, would be needed to prevent viruses from exploiting the honeypot network.
"They've shown it is possible to use this epidemically spreading immune agent to good advantage," says Jeff Kephart, a computer scientist at IBM in Hawthorne, New York, US. "The next step would be to look more carefully at the benefits and costs of this approach. I see promise in it."
The paper only discusses the mathematical model, and there is no effective implementation as yet. But Shir plans to release a simple example program soon and hopes that volunteers or a company will eventually implement the real thing across the internet.
Journal reference: Nature Physics (DOI: 10.1038/nphys177).
Not this crap again.
Some hacker already tried this a couple of years ago. It wound up causing more headaches than the worm it was trying to eradicate.
Ah the eternal question raises its ugly head again... Who decides (what is and isn't a virus)?
.4% of 200mil. is a LOT of machines acting as honeypots is still 800,000 machines. That's a bit impractical unless you are talking about using a donated distributed processing model similar to the Seti@Home project.
It's what mathematicians do. They can't all be expected to chase ducks & calculate their waddle.
I'd like to see a countermeasure that wreaked instant havoc upon the virus creator's computer and the virus creator personally.
the ACLU will put a stop to it, LOL.
Er... yes, it means precisely that this isn't a valid concept.
The idea is to destroy a worm, which causes damage through overwhelming network activity, by... creating another worm to do the same thing!
It's a stupid idea, and practice has already shown that it doesn't work. There's a simpler way to save the internet: you, at home, on your computer, run virus scans once a week. Problem solved.
Yup. I have never...not once...had a virus on my system, and it's connected full time to a high speed connection. I've been computing since 1981 when I got my first IBM PC.
Caution is all that's required, along with keeping up with anti-virus technology.
This idea is a bad one.
"Yup. I have never...not once...had a virus on my system, and it's connected full time to a high speed connection."
Same here. Ive been "connected" since about 97.
I've got you covered!
> There's a simpler way to save the internet: you, at home, on your computer, run virus scans once a week. Problem solved.
Sigh. Tell that to the wife and kids ("But I ran Norton last year!") Even as I type, I've got Spybot S&D running upstairs.
I'd rather tell it to the AV program's auto-scan function, or Windows' task scheduler.
Some computers just need regular attention from Kaspersky or NOD32, not Norton's system slowdown solutions...
> There's a simpler way to save the internet: you, at home,
> on your computer, run virus scans once a week. Problem solved.
Anyone sentient enough to do that is already at very low
risk of infection, particularly if they use a mail client
with a restricted or disabled preview pane. This does not
describe the average PC user, who will not be saved by
weekly scans.
Furthermore, once a week is not often enough. By the time
you discover and remove the latest keylogger, it's already
phoned-home with a week's worth of bank passwords. Even
live-updating and scanning daily won't protect the
otherwise careless from last night's new cracks.
Now, running Linux might provide a dramatic boost in
general immunity for the computationally inept, but that's
another thread fork.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.