HP researchers seek to "throttle" worms

Researchers at HP laboratories in Bristol have been working on a new technology designed to choke off Internet worms and viruses in an attempt to slow them down and control their spread.

The core logic of virus throttling hinges on the idea that a computer infected by a worm will often try to connect to as many different machines as possible within the shortest time-frame, whereas a computer under the control of a human will behave quite differently.

Human Web browsing will result in a connection rate of less than two outgoing Internet connection attempts per second. The Nimda and Code Red worms, on the other hand, would pump out up to 500 connection attempts per second.

No human interaction with a computer could cause such a high connection rate, so Williamson and his team are working out how to best choke off these rapid-fire connection attempts, hence dramatically slowing down the spread of a given worm.

"Since a machine that is infected, but throttled, isn't spreading the virus any more, the overall speed of infection is reduced. Also, since there will be fewer machines actively spreading the virus, the load on network infrastructure--routers for instance--will be reduced," Williamson said.

News source: ZDNet