Disabling Worms

Moore et al. show that containing worms is not practical on an Internet scale unless a large fraction of the Internet cooperates.

Active Immunization:
Deplay a large number of honeypots to detect infected hosts.
Immunize all infected hosts that contact a honeypot.

Model using SIR epidemic model.
360,000 susceptiple machines in 32-bit address space.
150 initially infected machines.
Worms launch 50 probes per second.