A countermeasure mechanism for fast scanning malware

This paper presents a cross-layer countermeasure mechanism to detect and contain self-propagating malware. The mechanism uses a detection technique at the network layer and a data-link containment solution to block traffic from an infected host. The concept has been demonstrated using a software prototype. An empirical analysis of network worm propagation has been conducted to test the capabilities of the developed mechanism. The results show that the developed mechanism is effective in containing self-propagating malware with almost no false positives.