White-Hat Worm to Fight Malware and Its Evaluation by Agent-Oriented Petri Nets ^†

Area of Science:

• Cybersecurity
• Computer Science
• Network Security

Background:

• The Mirai malware poses a significant threat to the rapidly expanding Internet of Things (IoT) ecosystem.
• Traditional vulnerability management methods are insufficient for the scale of IoT devices.
• A new defense strategy is required to combat IoT-specific malware.

Purpose of the Study:

• To propose and evaluate a novel white-hat worm strategy for combating Mirai malware.
• To introduce and model the concepts of lifespan and secondary infectivity for a defensive worm.
• To simulate the efficacy of the proposed white-hat worm against Mirai infections.

Main Methods:

• Development of a white-hat worm, an extension of the Hajime IoT worm.
• Introduction of 'lifespan' and 'secondary infectivity' as key worm characteristics.
• Formal modeling of the white-hat worm using agent-oriented Petri nets (PN 2).
• Simulation of the interaction between the white-hat worm and Mirai malware.

Main Results:

• A short lifespan for the white-hat worm effectively reduces the overall presence of Mirai.
• When secondary infectivity is low, the white-hat worm's effectiveness is dependent on its lifespan.
• High secondary infectivity enables the white-hat worm to be effective against Mirai, irrespective of its lifespan.

Conclusions:

• The proposed white-hat worm, incorporating lifespan and secondary infectivity, presents a viable defense against Mirai.
• The formal model (PN 2) effectively simulates and evaluates cybersecurity defense strategies.
• Tailoring worm characteristics like lifespan and infectivity is crucial for optimizing IoT malware defense.