In applying formal evaluation to worm defense design, we emphasize early insertion of formal analyses in distributed malware defense evaluation and apply an executable rewriting logic specification to drive both simulation and property validation of a collaborative group-based worm defense. An important aspect of the algorithm under consideration is its distributed and probabilistic nature, which makes the defense system harder to attack but also complicates the ability of designers to fully understand its behavioral properties. We have demonstrated an approach to formally analyzing our case-study worm defense algorithm, employing tools that facilitate both statistical simulation and property validation, documented in the paper "Applying Formal Evaluation to Worm Defense Design" by R. Sharykin and P.A. Porras in Proceedings of the 26th International Performance Computing and Communications Conference in New Orleans, Louisiana, March 2007.

• FormalWorm.pdf

Principal Investigator: Phillip Porras