White-Hat Worm to Fight Malware and Its Evaluation by Agent-Oriented Petri Nets

Abstract

A new kind of malware called Mirai is spreading like wildfire. Mirai is characterized by targeting Internet of Things (IoT) devices. Since IoT devices are increasing explosively, it is not realistic to manage their vulnerability by human-wave tactics. This paper proposes a new approach that uses a white-hat worm to fight malware. The white-hat worm is an extension of an IoT worm called Hajime and introduces lifespan and secondary infectivity (the ability to infect a device infected by Mirai). The proposed white-hat worm was expressed as a formal model with agent-oriented Petri nets called PN 2 . The model enables us to simulate a battle between the white-hat worm and Mirai. The result of the simulation evaluation shows that (i) the lifespan successfully reduces the worm’s remaining if short; (ii) if the worm has low secondary infectivity, its effect depends on the lifespan; and (iii) if the worm has high secondary infectivity, it is effective without depending on the lifespan.

Botnet Defense System: Concept, Design, and Basic Strategy

“…In Table 1, the yellow highlighted cells show the results when only 5 worms were launched instead of 19 ones. When the worm's lifespan is short (See Table 1a), i.e., = 1, all the strategies launched 19 worms because the worm's capability was decided to be insufficient according to Equation (7). When = 3 and ρ ≥ 75% (See Table 1b), L Few-Elite and L Env-Adaptive launched only five worms.…”

“…Yamaguchi [7] defined a worm that drives out the Mirai botnet and deletes itself as a white-hat worm. It is characterized by two attributes: secondary infection possibility and lifespan.…”

“…In Ref. [7], he revealed the following properties between a white-hat worm's capability (lifespan , secondary infection possibility ρ) and its effect: (i) if is short, the worm becomes extinct in course of time; (ii) if ρ is high, the worm is effective regardless of ; and (iii) if is long, the worm is effective even if ρ is low. However, there is no discussion about how to systematically launch the white-hat worm in response to Mirai's infection situation.…”

“…This is because some networks have a different topology but the same density, and Ref. [7] indicated that # nodes is not important than the worm's capability. We propose a launch strategy called Environment-Adaptive to compensate for the influence from the network.…”

“…Mirai penetrates only to the dynamic memory of a device, therefore we can delete Mirai by rebooting the infected device [4]. However, Moffitt [5] reported that Mirai can reinfect the device within minutes unless the vulnerability is patched. IoT devices are explosively increasing.…”