TECHNOLOGY FOR CHANGE

Stopping the Spread: The Future of Deworming Software for Networks

Dave Greenfield | Date: 04-02-10 | Comments

Researchers at Pennsylvania State University are taking on Conficker, developing deworming software that could stop the spread of such worms and viruses before they infect other networks.

Fears of the Conficker virus rival the hysteria that often accompanies news of impending pandemics. The self-recreating worm infected millions of computers, creating security vulnerabilities. England�s Greater Manchester Police Department is feeling the lingering effects of the worm: The department detected Conficker in its system and had to keep its computers off of a national criminal database as a result. Researchers at Pennsylvania State University (PSU) are taking on Conficker, developing deworming software that could stop the spread of such worms and viruses before they infect other networks.

The software builds off of existing ADS, or anomaly detection system, algorithms. The PSU research team is designing it to protect other computers from falling victim to Conficker or other invaders. It works by alerting your network�s intrusion-detection system to scan within the network. Some of this is legitimate, and the new algorithm can estimate how much of this scanning can go on before a device is locked out, preventing the spread to other machines.

If the algorithm detects anomalous scanning, it initiates a lockdown. This is different from software now on the market, which, according to PSU professor Peng Liu, �does not know what the best threshold is.� That is, it can fail to alert the network to a worm or, on the other extreme, it can disrupt activity with false alarms. Liu adds, �Network traffic is so complicated that you can�t just fire off an alert each time you see something that�s abnormal.�

The software will buy time by blocking some machines from the network. This will keep a virulent worm from spreading, but if uninfected computers are targeted, it can cause disruption throughout the entire network.

PSU�s software is a step forward in creating programs that can detect anomalous scanning without throwing false alarms that disrupt operation. The hope is that such software will help prevent the widespread infection caused by Conficker and other worms.