We study the strengths, weaknesses, and potential synergies of two complementary worm quarantine defense strategies under various worm attack profiles. We observe their abilities to delay or suppress infection growth rates under two propagation techniques and three scan rates, and explore the potential synergies in combining these two complementary quarantine strategies. We compare the performance of the individual strategies against a hybrid combination strategy, and conclude that the hybrid strategy yields substantial performance improvements, beyond what either technique provides independently. This result offers potential new directions in hybrid quarantine defenses.

@INPROCEEDINGS{porras:worm:2004,
  AUTHOR = {Phillip Porras and Linda Briesemeister and Keith Skinner and Karl Levitt and Jeff Rowe and Yu-Cheng Allen Ting},
  TITLE = {A hybrid quarantine defense},
  BOOKTITLE = {Proceedings of the 2004 ACM Workshop on Rapid Malcode (WORM)},
  YEAR = {2004},
  PAGES = {73--82},
  DOI = {http://doi.acm.org/10.1145/1029618.1029630},
}

• worm2004.pdf