Fighting self-replication with self-replicationIn the biological immune system, immune cells with receptors that happen to match a given antigen reasonably well are stimulated to reproduce themselves. This provides a very strong selective pressure for good recognizers, and by bringing a degree of mutation into play, the immune cell is generally able to come up with immune cells that are extremely well-matched to the antigen in question. One can view this as a case in which self-replication is being used to fight a self-replicator (the virus) in a very effective manner. One can cite a number of other examples in nature and medical history where this strategy has been employed, such as the deliberate use of the myxoma virus in the 1950's to curtail an exploding rabbit population in Australia [McNeill1976, Levine1992]. The self-replicator need not itself be a virus. In the case of the worldwide campaign against smallpox, launched by the World Health Organization in 1966, those who were in close contact with an infected individual were all immunized against the disease. Thus immunization spread as a sort of anti-disease among smallpox victims. This strategy was amazingly successful: the last naturally occurring case of smallpox occurred in Somalia in 1977 [Bailey1975]. We propose to use a similar mechanism, which we call the ``kill signal'', to quell viral spread in computer networks. When a computer discovers that it is infected, it can send a signal to neighboring machines. The signal conveys to the recipient the fact that the transmitter was infected, plus any signature or repair information that might be of use in detecting and eradicating the virus. If the recipient finds that it is infected, it sends the signal to its neighbors, and so on. If the recipient is not infected, it does not pass along the signal, but at least it has received the database updates, effectively immunizing it against that virus. Theoretical modeling has shown the kill signal to be extremely effective, particularly in topologies that are highly localized or sparsely connected [Kephart and White1993, Kephart1994b].
|