Algorithm Finds Malware Source

Wednesday, August 15, 2012 @ 03:08 PM gHale


Swiss scientists have developed an algorithm that can locate spammers as well as the source of a computer virus or malware.

The algorithm finds the source by only checking a small percentage of the connections in a network, said Pedro Pinto, postdoctoral researcher at the Audiovisual Communications Laboratory of the Swiss Federal Institute of Technology (EPFL).

RELATED STORIES
Microchip Boost from Wireless
Ultracapacitor Delivers a Steady Jolt
New Tool Shows Security Strength
To Catch a Thief: Cyber Forensics

If you would like to find the source of a virus, malware or spam-attack it is impossible to track the status of all nodes on the Internet, Pinto said. “That would mean you would need about 1 billion sensors. And you don’t want to monitor the entire Internet,” he added.

Instead he and his colleagues devised an algorithm that shows it is possible to estimate the location of the source from measurements collected by sparsely placed observers or sensors.

By using the algorithm the specific computer in the network from which the spam mail is sent can be found so the network provider can shut it down for instance, Pinto said. Using the same method, it would be possible to pinpoint the first computer where a virus ended up injected, he said.

The location of the source comes by using the network structure, looking at who connects to whom, as well as determining the time of arrival of the virus to the sensors, Pinto said.

The algorithm only has to analyze ten to twenty percent of all the nodes in a network to determine what the likely source of an attack is, Pinto said. “Sometimes this is five percent,” he said, pointing out the number of nodes that need analyzing depends on the complexity of the network.

The workings of the algorithm were in a paper entitled “Locating the source of diffusion in large-scale networks.”

The scientists expect the algorithm can work for other things besides finding computer culprits. The method could find the source of biological viruses and epidemics like SARS — the algorithm could determine the city in which the virus appeared for the first time. But it could also find the source of a rumor spreading on Facebook or sniff out the source of an airborne contaminant let loose by terrorists in a subway network, according to the scientists.

While the technique could have uses in many different industries, the first commercial interest in the algorithm has come from computer security companies, Pinto said. “Some companies emailed me after we published the paper last Friday,” he said, adding that he did not want to disclose the names of the companies.

Another natural fit for the technology would be its use by public services like governments, Pinto said. Besides looking for ways to use the technology commercially, the scientists will also try to improve the results of the algorithm.



Leave a Reply

You must be logged in to post a comment.