For cyber worms, speed can be fatal

Computer security researchers are developing ways of protecting PCs from malicious programs known as worms by monitoring how fast the data is sent through networks.

The scientists at Penn State University in the US said they have devised new anti-worm technology that can identify and contain worms milliseconds after an attack by analysing data packets’ rate or frequency of connections, and their diversity of connections to other networks.

That allows the technology they term “proactive worm containment” to react more quickly to security threats, university researchers said.

“A lot of worms need to spread quickly in order to do the most damage, so our software looks for anomalies in the rate and diversity of connection requests going out of hosts,” Peng Liu, a Penn State information sciences and technology professor and lead researcher on the project, said in a statement.

Researchers say that many current security methods focus on “signature or pattern identification” and cannot respond fast enough to prevent worms from exploiting networks.

Those approaches, they say, often miss worms that mutate automatically, bypassing the existing anti-worm controls. The Penn State technique won’t catch slower-spreading worms, although Liu said current technologies already pick those up.