Posted on 12/03/2005 6:46:01 AM PST by Neville72
(via KurzweilAI.net)
A cure for computer viruses that spreads in a viral fashion could immunise the internet, even against pests that travel at lightning speed, a mathematical study reveals.
Most conventional anti-virus programs use "signatures" to identify and block viruses. But experts must first analyse a virus before sending out the fix. This means that rapidly spreading viruses can cause widespread damage before being stopped.
Some researchers have developed artificial "immune systems" that automatically analyse a virus meaning a fix can be sent out more rapidly. In practise, however, computer viruses still tend to spread too quickly.
Now Eran Shir, and colleagues at Tel-Aviv University in Israeli, have applied network theory to the problem, and believe they have come up with a more effective solution.
Part of the problem, the researchers say, is that countermeasures sent from a central server over the same network as the virus it is pursuing will always be playing catch-up.
They propose developing a network of "honeypot" computers, distributed across the internet and dedicated to the task of combating viruses. To a virus, these machines would seem like ordinary vulnerable computers. But the honeypots would attract a virus, analyse it automatically, and then distribute a countermeasure.
Healing hubs But the honeypots would be linked to one another via a dedicated and secure network. This way, once one has captured a virus, all the others will quickly know about the infection immediately. Each honeypot then acts as a hub of healing code which is disseminated to computers connected to it. The countermeasure then spreads out across the broader network.
Simulations show that the larger the network grows, the more efficient this scheme should be. For example, if a network has 50,000 nodes (computers), and just 0.4% of those are honeypots, just 5% of the network will be infected before the immune system halts the virus, assuming the fix works properly. But, a 200-million-node network – with the same proportion of honeypots – should see just 0.001% of machines get infected.
Security measures, such as encryption, would be needed to prevent viruses from exploiting the honeypot network.
"They've shown it is possible to use this epidemically spreading immune agent to good advantage," says Jeff Kephart, a computer scientist at IBM in Hawthorne, New York, US. "The next step would be to look more carefully at the benefits and costs of this approach. I see promise in it."
The paper only discusses the mathematical model, and there is no effective implementation as yet. But Shir plans to release a simple example program soon and hopes that volunteers or a company will eventually implement the real thing across the internet.
Journal reference: Nature Physics (DOI: 10.1038/nphys177).
I said it was simpler; I never said it was going to happen anytime soon...
Phishing is a separate issue from counteracting worms, but you have to admit that a once-a-week scan is better than the never-in-my-lifetime scans most people perform...
> Phishing is a separate issue from counteracting worms, ...
Yup, and there, only user brainwork will suffice. Most,
however, have to get nailed once before they begin to
critically examine the lures. A neighbor here went to the
Sheriff's office to comply with a threatening email from
the "CIA"!
> ... but you have to admit that a once-a-week scan is
> better than the never-in-my-lifetime scans most people
> perform...
Agreed. And the first time they find one, it might
influence them to be a bit more aggressive about it.
This was done in the 50's - yes, I know it was before the creation of the internet and that is what makes its actions so prescient. Go grab your old Mad Magazines and goto the Spy vs. Spy cartoon - before the secure honeypot there was back and there was white.
Paperback book recommendation: Dan Brown's 'Digital Fortress'. My first Dan Brown book. Wow, can that guy write a thriller! It's all about this stuff.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.