This paper proposes a method to eliminate malicious worms in multiple unobservable areas for botnet defense. We use the Botnet Defense System (BDS) with path specified white hat worms for reconnaissance and elimination. For reconnaissance, we evaluate two approaches: accuracy focused reconnaissance, which follows high degree nodes for precise detection, and time focused reconnaissance, which follows adjacent observable nodes for faster scanning. Accuracy focused reconnaissance achieved 100% detection, while time focused reconnaissance reduced scanning time to 23% of the former while maintaining 84% accuracy. For elimination, we propose high degree targeting elimination, which ambushes worms at high degree nodes for fast removal, and brute force elimination, which eliminates all unobservable nodes for complete eradication. High degree targeting elimination reduced average elimination time to 4% of brute force elimination, while brute force elimination ensured complete worm removal, with maximum elimination time at 34% of the former. This study demonstrates the effectiveness of path specified white hat worms in reconnaissance and elimination, optimizing botnet defense in BDS.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Methods for Reconnaissance and Elimination of Malicious Worms in Multiple Unobservable Regions Using Path Specified Worms

  • Ryo Yamashita,
  • Shingo Yamaguchi

摘要

This paper proposes a method to eliminate malicious worms in multiple unobservable areas for botnet defense. We use the Botnet Defense System (BDS) with path specified white hat worms for reconnaissance and elimination. For reconnaissance, we evaluate two approaches: accuracy focused reconnaissance, which follows high degree nodes for precise detection, and time focused reconnaissance, which follows adjacent observable nodes for faster scanning. Accuracy focused reconnaissance achieved 100% detection, while time focused reconnaissance reduced scanning time to 23% of the former while maintaining 84% accuracy. For elimination, we propose high degree targeting elimination, which ambushes worms at high degree nodes for fast removal, and brute force elimination, which eliminates all unobservable nodes for complete eradication. High degree targeting elimination reduced average elimination time to 4% of brute force elimination, while brute force elimination ensured complete worm removal, with maximum elimination time at 34% of the former. This study demonstrates the effectiveness of path specified white hat worms in reconnaissance and elimination, optimizing botnet defense in BDS.