On The Collective-Intelligence-based Worm Scanning Strategy

The computer worm has the ability of replicating itself which can spread in the internet automatically. So, it threatens the safety of network. Get the method of scanning using by the worm is to confront the spread of worm effectively. The main purpose of this paper is to design the two possible scanning methods using by the future worm.In this paper, we give a brief introduction to current development of internet safety firstly, introducing the existing worm and the exploration strategies of worm. After a simple review of group intelligent algorithm, this paper studies the scanning behavior of worms with group intelligence characteristic.To propagate over the network, the worms need to scan many IP addresses in order to find the vulnerable hosts and infect them. On the basic characteristic of the swarm intelligence algorithm, we design the exploration method based on the Ant colony algorithm, and implement by simulating them on the computer. The scanning strategies based on Ant colony algorithm can estimate the space by using some subsidiary information. In order to find the IP address of the parts of most clustered vulnerable systems in the internet, each worm will record the scanning results to help deciding its next scanning direction. The new born worms can also inherit those results from its parent worms. The simple individual behaviors of worms are aggregated as a collective behavior in global to perform efficient scanning. We think that this scanning method is more efficient when the vulnerable hosts are not uniformly distributed.Next, we introduce the spreading principle of Self-stopping worm that can stop spreading action according to a certain probability which make them can not infect all the vulnerable host. The character of this exploration strategy is strengthening the hidden ability in the spreading process which shows the function of self-protection.The main task of this paper is to compare the spreading efficiency of 3 main scanning strategies among random search, Anting search and Self-stopping search by corresponding data analysis. This paper tested the scanning strategy discussed above by computer simulation. The worm with swarm intelligence has high efficient scan under the condition of the irregular vulnerable host. So, designing a effective method to confront this kind of worm is necessary.