Enterprise Worm: Simulation, Detection, and Optimal Containment

Cost-effective containment requires accurate estimation of worm virulence and extent of network damages under various game scenarios. In this regard, we develop a maximum likelihood estimation algorithm to estimate the size of susceptible population using inter-arrival timing information collected by the dark port detectors. Based on the idea of worm propagation detection and worm virulence estimation algorithm, we propose two collaborative containment strategies which can effectively containment a local scanning worm and cause minimum service disruption.