Worm damage minimization in enterprise networks

Attackers utilize many forms of intrusion via computer networks; currently, worms are an important vector with the potential for widespread damage. None of the strategies is effective and rapid enough to mitigate worm propagation. Therefore, it is extremely important for organizations to better understand worm behaviour and adopt a strategy to minimize the damage due to worm attacks. This paper describes an approach to minimize the damage due to worm infection in enterprise networks. The approach includes: (1) analyzing the effect of parameters influencing worm infection: openness, homogeneity, and trust, (2) predicting the number of infected nodes by fuzzy decision, and (3) optimizing the trust parameter to minimize the damage by fuzzy control. Experiments using real worm attacks show that the selected parameters are strongly correlated with actual infection rates, the damage prediction produces accurate estimates, and the optimization of the selected parameter can lessen the damage from worm infection.