A software to beat computer viruses

The irritating computer viruses could be beaten in their own game by immunity software that spreads faster than the virus itself, says a team of Israeli computer experts.

Their proposal relies on setting up a network of shortcuts through the internet that only antiviral programmes can use, allowing them to immunise computers before a virus arrives, according to a paper .Currently available anti-virus software aims to stop attacks on healthy computers and to clean up those already infected. Teams work around the clock to look for new viruses and build software ‘patches’.

These patches are distributed to computer users to install on their machines, hopefully before the virus arrives. But the strategy means that some viruses stay one step ahead for days, wreaking havoc as they spread. “The software companies just regard the internet as a sophisticated FedEx service,” said Eran Shir of Tel Aviv University, the lead author of the paper.

“Our focus is to immunise the whole network, not to clean individual computers or fix what is already broken,” he said. The strategy, in other words, intends to use the malicious code’s own techniques to distribute immunity.

In the paper, titled ‘Distributive immunisation of networks against viruses using the ‘honey-pot’ architecture’, the authors have made a proposal “to propagate the immunisation agent as an epidemic.”

“The main problem with epidemic vaccine propagation is that it is bound to lag behind the virus. We suggest giving the vaccine an advantage over the virus by allowing it to leapfrog through a separate, overlapping and partially correlated network. This enables the anti-virus to contain the epidemic efficiently.”

Shir and his colleagues have proposed a system in which a few “honeypot” computers lie in wait for viruses. These computers run automated software that first identifies the virus and then sends out its “signature” across the internet. This enables a sentinel programme on all other computers in the network to identify the virus and bar it before it can attack them.

The real trick is to make sure that the antiviral signature travels faster through the Internet than the virus itself, so that whenever a malicious programme arrives it finds a sentinel blocking the way. “You need to build extra links into the network that only the immune agent can use,” says Shir. These extra links would form a parallel network connecting the honeypot computers.

Assuming that the shortcuts can be set up and made secure, the anti-viral signature should be able to stay one step ahead. Shir did not have any plans to commercialise the idea and hoped that the scheme would be realised in an open-source project.