Anit-worm-measure parameter determining apparatus, number-of-nodes determining apparatus, number-of-nodes limiting system, and computer product

Abstract

An anti-worm-measure parameter determining apparatus determines parameters for controlling timing for an anti-worm-measure means to start blocking of a communication by a worm in a network, for preventing a spread of the worm. An infectivity calculating unit calculates infectivity of the worm based on number of nodes connected to the network. A number-of-infected-nodes estimating unit calculates an expected value of number of infected nodes at a time when the worm transmits a predetermined number of packets, based on the infectivity calculated by the infectivity calculating unit.

Description

[0001]This is a Divisional of application Ser. No. 11 / 485,807, filed Jul. 13, 2006.BACKGROUND OF THE INVENTION[0002]1. Field of the Invention[0003]The present invention relates to a technology for preventing an unknown worm from spreading using an anti-worm-measure means.[0004]2. Description of the Related Art[0005]In recent years, according to the spread of the Internet, damages caused by worms, which are a kind of computer viruses, frequently occur. The worms not only commit illegal acts like destructive acts but also use security holes of an operation system and the like for wrong purposes to hack into other information processing apparatuses connected by a network and repeat autosynthesis. Therefore, the damages caused by the worms tend to rapidly spread in a wide area.[0006]To prevent the expansion of the damages by the worms, it is effective to install an anti-worm-measure program and monitor packets flowing on the network. Since subspecies and new species of the worms often a...

AI Technical Summary

Problems solved by technology

In recent years, according to the spread of the Internet, damages caused by worms, which are a kind of computer viruses, frequently occur.

The worms not only commit illegal acts like destructive acts but also use security holes of an operation system and the like for wrong purposes to hack into other information processing apparatuses connected by a network and repeat autosynthesis.

Therefore, the damages caused by the worms tend to rapidly spread in a wide area.

However, a certain degree of period is necessary from the time when a certain sign of communication by an unknown worm is detected in certain communication until the time when it is determined that the communication is communication by the worm and the communication is blocked.

If this period is reduced, it is highly likely that normal communication is detected as communication by an unknown worm by mistake.

When such misdetection occurs, it is likely that the normal communication is blocked to hinder business and the like.

However, when the parameters are set with emphasis put on prevention of the misdetection, the period until the communication is blocked is prolonged and infection of the worm spreads during the period.

Images