Swarm Intelligence Fights Worms with Ants
By Cara Garretson, Veteran Business and Technology Journalist
A professor and two graduate students from Wake Forest University spent the summer at a federal computer lab developing digital ants that proactively search networks for signs of computer worms and other security threats.
These digital ants in many ways act like their real-life counterparts, according to an article about the research posted on the Wake Forest Web site.
Once they detect a worm — malware that self-replicates to spread itself to as many PCs as possible and then infect them — or similar security threats, ants converge at that location on the network to attract the attention of a human who can step in and thwart the threat.
Ants are known to be able to ramp up their defense mechanisms rapidly when an intruder is detected, then resume their normal workload.
The researchers decided to see if a similar approach would work on a cyber threat.
Currently most security technology is reactive, taking action only against known threats that have been defined and can therefore be found. Researchers are hoping that by proactively scanning a network for unusual behavior these digital ants can discover so-called zero-day threats before they do harm.
The concept, called “swarm intelligence,” is being pioneered by Glenn Fink, a research scientist at Pacific Northwest National Laboratory (PNNL) in Richland, Wash.
PNNL is one of ten Department of Energy labs in the country and researches new methods in cybersecurity.
Fink was familiar with work being done at Wake Forest under Errin Fulp, a computer science professor and network security expert, who has been working on faster security scanning by leveraging parallel processing techniques.
Fink invited Fulp and two graduate students, Wes Featherstun and Brian Williams, to combine swarm intelligence with parallel processing in a test to see how quickly the digital ants could swarm on security threats.
Over the summer the researchers built a 64-node network and deployed 3,000 different types of digital ants charged with looking for evidence of worms and other threats.
As the ants moved through the network, they would leave digital trails, much like the scent trails that real-life ants leave to guide other ants.
Each time a digital ant identified a sign of a threat, it would leave behind a bigger trail, or stronger scent.
The stronger scent would then attract more ants, quickly creating a swarm to warn researchers of a possible security concern.
As a control measure, the researchers installed “sentinels” at each machine, reporting to network “sergeants” that are monitored by humans who supervise the “colony.”
The humans ultimately control the ants so that they can’t infiltrate PCs without authorization, the researchers say.
In the researchers’ test the ants were successfully able to find a worm released on the test network, says the Wake Forest article.
PNNL has extended the research project and will continue working on swarm intelligence.
There are hopes that this approach will eventually help production networks prevent threats, although the researchers say that the digital ants work best in large networks that have many identically configured machines on them, such as those in governments, enterprises and universities.
* * *
Stay Informed With ISR News Alerts:
* * *
Cara Garretson is a veteran business and technology journalist with over 15 years experience writing and editing for print and online publications, including a position as Senior Editor for Buyer’s Guides at Network World and as a Senior Writer at Red Herring. Cara contributes regularly to CIOZone.com.
CIOZone.com is the first of its kind online meeting place for CIOs. It is built upon the foundation of social networking and combines user generated content and expert editorial together around an open source platform.
The Publisher gives permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author and to Information-Security-Resources.com
Filed under: Breach, CIOZone, Cara Garretson, Class Action Lawsuit, D&O Liability, FEATURE ARTICLE, Financial, Insider Threat, Sarbanes-Oxley, Uncategorized, due diligence, hackers, malware, national security, privacy
Comments
One Comment on Swarm Intelligence Fights Worms with Ants
-
Ants and worms, another way to look at system programming - SmartPlanet on
Thu, 29th Oct 2009 11:38 am
[...] Glenn Fink at the Pacific Northwest National Laboratory, a Department of Energy research center, thought about this and asked, why mimic the behavior of human cops and guards at all? Why not model insect behavior? [...]
Tell me what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!
