Modeling the Co-evololution DNS Worms and Anti-worms in IPv6 Networks

Recently, an interest has arisen for network worms that propagate using domain name servers (DNS) in order to discover victim hosts.These worms generate random strings, as possible network domain names, and then query domain name servers in order to discover the corresponding IP addresses. In this paper we present models for the dynamics of the co-evolution of worm agents in the presence of anti-worm agents that move in the network in order to stop worm propagation. The proposed models consider anti-worm agents who know the network and anti-worm agents thaServerst do not know it and need to issue queries in order to discover valid IP addresses. We,further, introduce "honeypot'' domain name servers that attempt to lure worms, introducing only a delay and providing no answer.We show that by simply delaying the response to DNS queries issued by the worm has little positive effect on the worms propagation.