Computer Ecology: Responding to Mobile Worms with Location-Based Quarantine Boundaries

The emerging malware that can spread through local wireless networks among mobile devices has so far received less attention than computer worms in the Internet. The local wireless links provide an alternative propagation path that circumvents intrusion detection at the service provider gateways. On the mobile nodes, conventional intrusion detection and intrusion response techniques such as address blacklisting and content filtering are more difficult to deploy due to the lack of central entities and the resource constraints of mobile nodes. We propose a new architecture for an intrusion response system that takes advantage of an infrastructure network (e.g., cell phone network) to manage security of the mobile nodes. Infection patterns in ad hoc networks are highly correlated with geographic proximity. Thus an ecologically inspired diffusion-reaction and advection models can provide estimates for the current spread of the worm. These estimates allow the service provider to precisely target a containment re-