Anting: An Adaptive Scanning Method for Computer Worms

Computer worms can self-propagate over a network and are becoming a critical risk to the network based applications. To propagate over the network, the worms need to scan many IP addresses to find vulnerable hosts. This paper addresses the worm scanning strategies with subsidiary information. Inspired by the natural ants, we propose an adaptive scanning method, named Anting, for worms. To perform focused scanning on the parts of most clustered vulnerable systems, each worm record some scanning results to help deciding its next scanning direction. The new born worms can also inherit those results from its parent worms. Each worm decides its scanning direction on its local estimation to the densities of reachable addresses or vulnerable hosts in different parts of subspaces. The simple individual behaviors of worms are aggregated as a collective behavior in global to perform efficient scanning. We argue that this scanning method is more efficient when the vulnerable hosts are not uniformly distributed. We also conduct some simulated experiments to validate this method