ACT: Attachment Chain Tracing Scheme for Virus Detection and Control Jintao Xiong Proceedings of the 2004 ACM workshop on Rapid malcode Presented By: Adam Anthony

Outline Significance Basic epidemiology Case Classifications Transmission Chains Quarantining Progressive Immunization Implementation Discussion

Project Significance New: First study to bring the concepts of contact tracing and a transmission chain into network security Significant: It promises to lead to the similar heightened success that biological epidemiologists have experienced for years Novel: Addresses a computer virus much like a biological virus and rarely concerns itself with the technology behind the virus.

Basic Epidemiology DNA Fingerprinting Contact Chain Tracing

Case Classifications

Transmission Chains Structure Identification Algorithm Quarantining

Structure A B C  A has a primary (layer 1 contact) link to B  All of B's unique primary links become layer 2 contacts to A  Pattern continues into layer 3, layer 4, etc. Contains address for

Chain Identification Algorithm (Part 1) 1. Detect a host exceeding an activity threshold R d 2. If the host does not belong to another chain (it is a normal case) 1. Set it up as the first link in a new chain 2. Set the host’s category to Suspicious 3. Set the category of all normal hosts reachable by the activity to linked and place them in the next link in the chain

Chain Identification Algorithm (Part 2) 3. If the host does belong to another chain (it is not normal) 1. Set host’s category to Suspicious 2. Add the host’s normal recipients to the chain and set their category to Linked 4. If the length of the chain at the host’s connection is equal to a threshold K, 1. Change all suspicious cases to probable 2. Change all linked cases to potential 3. Send the address and category information of all nodes in the chain to the quarantine system

Quarantine Process Policy strictness based on potential threat to the network, overall network configuration Only for Probable or Potential cases Hard Quarantine -- block and warn Rational User -- no benefit, no risk Soft Quarantine -- reduce probability of risky users

Soft Quarantine reduce probability of users taking risks Based on the “Rational User Assumption” Red flag = high risk, user less probable to open Yellow flag = medium risk, user slightly more probable to open Unflagged = is safe to open

Hard VS. Soft Quarantine Hard Practically Safer for a naive user More effective in slowing down virus spread False alarm = lost Soft Requires Rational user assumption Less effective in slowing down virus spread No lost

Experimentation Full simulation Generate network graphs Random and power law Allow the network to advance one step at a time Enforce different policies, record the results

Progressive Immunization Selective Immunization = don't immunize all nodes Choose to Immunize nodes: Randomly Highest Degree Probable cases

Implementation Suggestions Chain Tracing Server installed at a logical point Case Finding Process Transmission Chain Management Process Quarantine implemented by the service- providing server (if it has it) Run 2 TCMP’s

Critical Discussion Too much assumption of state? Subjective design of simulation Hard VS. Soft quarantine Implications of progressive Immunization Scalability?

Conclusion

Questions

Appendix: Transmission Chain Management Algorithms

Algorithm: Case Finding Process for all sending addresses do check n i, the number of s host i has sent if n i >R d then report host i and its internal recipient addresses to the Transmission Chain Management Process end if end for

Algorithm: Contact Trace Stack Setup if (i is an internal normal host) or (i is an external host but is not an index case of any existing CTS) then assign i to be the index case of a new CTS S i for all receivers of i with normal category do add receivers to layer 1 of CTS S i change receivers' category to linked end for end if if i is an internal host then C i ⇐ suspicious end if

Algorithm: Update Contact Trace Stack C i ⇐ suspicious find (S i,L i ), the location of i for all r i, new recipients of i with normal category do S r ⇐ S i L r ⇐ L i +1 end for if L i = K then tc_finish(S i ) end if

Algorithm: Transmission Chain Finish for all suspicious hosts in CTS S i, do change their category to probable end for for all linked hosts in CTS S i, do change their category to potential end for pass the address and category information of all the nodes in S i to the quarantine process. Remove CTS S i