Mitigating Worm Propagation on Virtual LANs

Recent sophisticated worms have spread faster than the patch distribution. We propose an active defense framework that can defend against widespread by reacting quickly to quarantine infections. We propose deploying a number of detectors in the VLAN network. Using Monte Carlo simulations, we have shown that containment of future epidemics is possible and the probability of containment is a function of number of detectors, and that with our assumptions for worm scanning and infection speed characteristics, less than 2% detectors are enough to bring this probability very close to zero