Pulse quarantine strategy of internet worm propagation: Modeling and analysis

Worms can spread throughout the Internet very quickly and are a great security threat. Constant quarantine strategy is a defensive measure against worms, but its reliability in current imperfect intrusion detection systems is poor. A pulse quarantine strategy is thus proposed in the current study. The pulse quarantine strategy adopts a hybrid intrusion detection system with both misuse and anomaly detection. Through analysis of corresponding worm propagation models, its stability condition is obtained: when the basic reproduction number is less than one, the model is stable at its infection-free periodic equilibrium point where worms get eliminated. Numerical and simulation experiments show that constant quarantine strategy is inefficient because of its high demand on the patching rate at “birth”, whereas the pulse quarantine strategy can lead to worm elimination with a relatively low value. As patching almost all hosts in the actual network is difficult, the pulse quarantine strategy is more effective in worm elimination.

Figure optionsDownload as PowerPoint slideHighlights
► We apply pulse quarantine strategy to worm propagation.
► A hybrid IDS is used to assist the implement of pulse quarantine strategy.
► The hybrid intrusion detection system has an excellent performance.
► The condition which constant quarantine strategy demands for is hardly satisfied.
► Pulse quarantine strategy is more effective than constant quarantine strategy.