Optimum Identification of Worm-Infected Hosts

摘要

The authors have proposed a method of identifying super-spreaders by flow sampling and a method of extracting worm-infected hosts from the identified superspreaders using a white list. However, the problem of how to optimally set parameters, Φ, the measurement period length, m~*, the identification threshold of the flow count m within Φ, and H~*, the identification probability for hosts with m = m~*, remains unsolved. These three parameters seriously affect the worm-spreading property. In this paper, we propose a method of optimally designing these three parameters to satisfy the condition that the ratio of the number of active worm-infected hosts divided by the number of all the vulnerable hosts is bound by a given upper-limit during the time T required to develop a patch or an anti-worm vaccine.