Encounter-based worms: Analysis and defense

An encounter-based network is a frequently disconnected wireless ad hoc network requiring immediate neighbors to store and forward aggregated data for information disseminations. Using traditional approaches such as gateways or firewalls to deter worm propagation in encounter-based networks is inappropriate. We propose a worm interaction approach that relies upon automated beneficial worm generation to alleviate problems of worm propagations in such networks. To understand the dynamics of worm interactions and their performance, we mathematically model worm interactions based on major worm interaction factors, including worm interaction types, network characteristics, and node characteristics using ordinary differential equations and analyze their effects on our proposed metrics. We validate our proposed model using extensive synthetic and trace-driven simulations. We find that all worm interaction factors significantly affect the pattern of worm propagations. For example, immunization linearly decreases the infection of susceptible nodes, while on-off behavior only impacts the duration of infection. Using realistic mobile network measurements, we find that encounters are bursty, multi-group, and non-uniform. The trends from the trace-driven simulations are consistent with the model, in general. Immunization and timely deployment seem to be most effective in countering worm attacks in such scenarios, while cooperation may help in a specific case. These findings provide insight that we hope would aid in the development of counter-worm protocols in future encounter-based networks. (C) 2009 Elsevier B.V, All rights reserved.