Ants Vs. Worms — Computer Security Mimics Nature 104
An anonymous reader writes with this excerpt from Help Net Security:
"In the never-ending battle to protect computer networks from intruders, security experts are deploying a new defense modeled after one of nature's hardiest creatures — the ant. Unlike traditional security devices, which are static, these 'digital ants' wander through computer networks looking for threats ... When a digital ant detects a threat, it doesn't take long for an army of ants to converge at that location, drawing the attention of human operators who step in to investigate. 'Our idea is to deploy 3,000 different types of digital ants, each looking for evidence of a threat,' [says Wake Forest Professor of Computer Science Errin Fulp.] 'As they move about the network, they leave digital trails modeled after the scent trails ants in nature use to guide other ants. Each time a digital ant identifies some evidence, it is programmed to leave behind a stronger scent. Stronger scent trails attract more ants, producing the swarm that marks a potential computer infection.'"
Re:ridiculous references (Score:5, Informative)
They are talking about an ant-based algorithm, often used in optimization (routing, for example). Some information is here http://en.wikipedia.org/wiki/Artificial_Ants [wikipedia.org] and here.
Re:ridiculous references (Score:5, Informative)
Second link: http://en.wikipedia.org/wiki/Ant_colony_optimization [wikipedia.org] (sorry)
I think this is just some theoretical research that got picked up by someone never heard of Ant algorithms (it sounds impressive when you hear it the first time), but it can often be outperformed.
Re:ridiculous references (Score:4, Informative)
He just uses "ants and swarms" to replace "daemon and daemons".
His research is based on a network of 64 computers and has identified all sorts of different types of security breach that can be detected on a network (unauthorized ssh/ftp, botnet commands, spam-mailer, virus-in-a-mail-message, backdoor trojan) and that it might not be possible to detect where the originating commands are coming from - a whole load of servers or PC's might be infected.
The article states that there is a performance gain from having a separate task to detect each of these (he calls these ants). Since there are so many files, ports and devices to be checked, it is better to have multiple copies of each task. OS people would call these 'daemons'. Testing for all of these security breach requires a "swarm of ants" or a "plague of daemons" (whatever the aggreggate work of daemon is).
I guess talking about daemons in the server network would probably scare the h*ll out of Christian Managers.