Under Development

Artificial Hygiene for digital epidemics

IIIT-B's technology will eventually help connected devices stop unknown viruses from wrecking havoc on corporate networks, says Vinutha V

Hygiene helps prevent the propagation of diseases. Now there’s a similar philosophy being espoused for computers. A digital device does not know how to take care of itself and avoid infection. If it becomes infected, it does not know how to stop itself from infecting other connected devices be they notebooks, PCs, handhelds or smartphones.

Artificial Hygiene (AH), a new technology that makes it possible for an infected computer or a mobile computing device to automatically isolate infected components, say e-mail, from the network and ensure that a digital epidemic is arrested at the very start. Indian Institute of Information Technology, Bangalore (IIIT-B) is working on this technology.

Birth of a concept

Prof Asoke K Talukder of IIIT-B, who has developed Artificial Hygiene says, “The mechanism of how an individual follows hygiene to avoid the propagation of diseases, prompted me to come up with Artificial Hygiene. This technology in digital devices will ensure that it does not function as a carrier of a communicable disease.” In a digital society, we continue to get ‘more for less’. With an increase in processor speed and data capacity (bandwidth) every year, stopping unknown viruses at the susceptible state becomes increasingly difficult, and this calls for a new security solution. AH is a device-centric solution, which stops the destruction of data and arrests the transmission of viruses to other connected devices. It acts as a firewall within a device.

Self-healing for mobile computing

Through SaferNet, we are able to detect digital fever and stop the propagation of second generation viruses. Our current research focuses on the implementation of AH for worms Asoke K Talukder Professor IIIT-B

With wireless technology spreading fast, connected computing devices such as notebooks, handhelds and smartphones are becoming a way of digital life. As mobile computing relies on interoperability, openness and networking, the threat of security of digital assets are also on the rise. Security policies can work well in a networked environment where the system parameters are constant. However, they cannot be extended to or enforced upon alien networks and devices can easily get infected through malicious agents while roaming in an unsecured alien network or service. When infected mobile users return to their home network, the infected computer connects to the trusted zone of the secured network. If mobile computing devices are given self-healing capabilities of isolating a virus or worm, it stops the infection from spreading onto the network.

Talukder categorises viruses into three categories – first generation viruses, second generation viruses and third generation viruses. The AH process looks at all traffic to and from the e-mail and RPC (Remote Procedure Call) port from nodes in the network neighbourhood. It uses traffic flow like a thermometer. Like an infection causes fever in a human body, AH uses these traffic patterns to identify digital fever. If the device is infected and sending an e-mail virus or worms, all incoming IP packets from this infected node will be stopped using the ingress filter. Using Auto-Quarantine or Auto-isolation, the device will not pass on the virus to others. At a later time, when an antidote is available, the virus will be cleaned. Once the virus is eliminated, the traffic density will come down to normal. This will allow normal flow of traffic on all ports.

Tested successfully

The AH concept has been tested through a software system called SaferNet developed by Talukder at IIIT-B that has performed on both Linux and Windows. E-mail messages with a virus were sent to different unknown recipients. Without being aware of the type of the virus or its individual signature, the virus was detected and its propagation stopped. “Through SaferNet, we are able to detect digital fever and stop the propagation of second generation viruses. Our current research focuses on the implementation of AH for worms. Our initial results show that we will be able to stop a new worm without being aware of the specific signature of the worm,” says Talukder. The research will be presented in the IEEE Indicon conference at IIT-Kharagpur by end 2004.

IIIT-B has filed a patent for AH in Texas. The prototype is expected to reach out to the corporate world. “We are looking at further research on viruses on SMS, spam and spyware and to proceed on AH we are expecting funds from investors,” he adds.