Email Worm Mitigation by Controlling the Name Server Response Rate

Email worms and the spam associated with them are one of the main operational security issues today because they waste time, money and resources. The high incidence of email worms today clearly indicates that current network defence mechanisms yield rather meagre results in mitigating this class of self-propagating malicious program. In this work, we build on the observation that email worms rely on the local name servers to propagate, and propose a novel approach to slow down their propagation by means of limiting the response rate of local name servers, which are topologically near the infected user machines. We conduct extensive simulation experiments that involve email network, email user behaviour, email propagation, and physical network modelling, and show that our approach is promising for slowing down email worm epidemics.