Optimization of NACHI Spreads

1
Optimization of NACHI Spreads

• s1080057 Satoshi Onoda
• Supervised by Prof. Hiroshi Toyoizumi

2
Background

• Worm is one of the computer virus, which spreads
  by itself.
• The worm, which kills other worms exists.
• These worms are effective in countermeasure
  against malicious worms.
• But, these worms may have a bad influence on the
  network.

3
Purpose

• To find a method finding the optimum scan rate of
  NACHI, which can terminate MSBLAST and control
  the increase of NACHI as little as possible.

4
MSBLAST
Scan IP
Discover alive Computer

• TypeWorm
• Platform Windows 2000, XP

Send Wrong Data for 2k
Send Wrong Data for XP
to XP
to XP
to 2k
to 2k
Fail to Expect
Succeed to Expect
Instruct to Download
80
20
Fail
Succeed
Instruct to Execute
5
NACHI
Kill MSBLAST

• Type Worm
• Platform Windows 2000, XP
• Defect ICMP packets increasing on the
  network

Check whether already Patched or not
Yet
Already
Update
Scan IP
Discover alive Computer
Expect Security Hole
Instruct to Download Execute
6
Relation between NACHI and MSBLAST
a
r
b
MSBLAST
NACHI
7
Model -equation-

• x(t) of the computers infected MSBLAST at
  time ty(t) of the computers infected NACHI at
  time tr propagation rate of MSBLASTa
  propagation rate of NACHIb in which NACHI
  kills MSBLAST per second

8
Experiment

• 1.NACHI or MSBLAST runs in one client
• 2.Capture packets from first infected client
• 3.Find scan rate

9
Result of Experiment
10
Model -graph-
11
Global Maximum of BLAST
x(t)
t
12
Algorithm

• Decide the constants
• Decide the value of max
• Solve x(t)max for a
• Divide a by infecting probability
• Obtain optimum scan rate of NACHI, s

13
Optimum Scan Rate for some max
, s
14
Conclusion

• We obtained a method to determine the optimum
  scan rate of NACHI with some conditions.
• When we need the good worm like NACHI, we must
  find the optimum rate.