1. Optimization of NACHI Spreads s1080057 Satoshi Onoda Supervised by Prof. Hiroshi Toyoizumi

2. Background Worm is one of the computer virus, which spreads by itself. The worm, which kills other worms exists. These worms are effective in countermeasure against malicious worms. But, these worms may have a bad influence on the network.

3. Purpose To find a method finding the optimum scan rate of NACHI, which can terminate MSBLAST and control the increase of NACHI as little as possible.

4. MSBLAST Type:Worm Platform: Windows 2000, XP Scan IP Discover alive Computer Send Wrong Data for 2kSend Wrong Data for XP Fail to ExpectSucceed to Expect Fail Instruct to Download Succeed Instruct to Execute to XP to 2k 80%20%

5. NACHI Type: Worm Platform: Windows 2000, XP Defect: ICMP packets increasing on the network Kill MSBLAST Update Check whether already Patched or not Instruct to Download & Execute Scan IP Yet Already Expect Security Hole Discover alive Computer

6. Relation between NACHI and MSBLAST MSBLASTNACHI ar b

7. Model -equation- x(t) :# of the computers infected MSBLAST at time t y(t) :# of the computers infected NACHI at time t r :propagation rate of MSBLAST a :propagation rate of NACHI b :# in which NACHI kills MSBLAST per second

8. Experiment 1.NACHI or MSBLAST runs in one client 2.Capture packets from first infected client 3.Find scan rate

9. Result of Experiment Range of Scanning IPRequired Time [sec] NACHI 192.168.0.0 - 192.168.255.2554495 192.165.0.0 - 192.165.255.2553050 61.157.0.0 - 61.157.255.2551018 (256*256 random IPs)1008 MSBLAST 203.78.0.0 - 203.82.254.25429582 Rate [/sec] 41.084 10.991

10. Model -graph-

11. Global Maximum of BLAST t’t’ x(t ’ )

12. Algorithm 1. Decide the constants 2. Decide the value of max 3. Solve x(t ’ )=max for a 4. Divide a by infecting probability Obtain optimum scan rate of NACHI, s

13. Optimum Scan Rate for some max, s

14. Conclusion We obtained a method to determine the optimum scan rate of NACHI with some conditions. When we need the good worm like NACHI, we must find the optimum rate.