Ants Vs. Worms — Computer Security Mimics Nature

An anonymous reader writes with this excerpt from Help Net Security: "In the never-ending battle to protect computer networks from intruders, security experts are deploying a new defense modeled after one of nature's hardiest creatures — the ant. Unlike traditional security devices, which are static, these 'digital ants' wander through computer networks looking for threats ... When a digital ant detects a threat, it doesn't take long for an army of ants to converge at that location, drawing the attention of human operators who step in to investigate. 'Our idea is to deploy 3,000 different types of digital ants, each looking for evidence of a threat,' [says Wake Forest Professor of Computer Science Errin Fulp.] 'As they move about the network, they leave digital trails modeled after the scent trails ants in nature use to guide other ants. Each time a digital ant identifies some evidence, it is programmed to leave behind a stronger scent. Stronger scent trails attract more ants, producing the swarm that marks a potential computer infection.'"

Re:Taking the analogy further...

[Lesrahpem]

This reminds me of how one of the first worms was actually created. Xerox made it for going around their computers after hours and doing various checks and system maintainence. It got out of control and DoS'ed their network.

The EU Serenity Project is using the same approach

[Futurepower(R)]

MOD PARENT UP. It is apparently correct to be skeptical.

The Serenity Project [serenity-project.org] in the European Union is using the same approach. They call it "Ambient Intelligence(AmI)." The level of intelligence in the Serenity project may be indicated by the fact that, at present, 2009-09-26, 02:47 PDT, there is no space before "(AmI)". The Ambient Intelligence in the Serenity Project is very low, apparently.

Someone who worked for SAP Labs France [sap.com] told me the SAP Labs France part of the Serenity Project is so poorly managed that smart people leave as soon as they can find other jobs.

Apparently the only way of providing security that actually works is the Open BSD method [openbsd.org]: Audit the code. No number of "ants" can provide the security of audited code.

Want more biological humor? Read about SAP's customer-focused ecosystem [sap.com]. It supposedly fosters "... an ideal environment for ongoing innovation and value creation..." Biological references are apparently the hot new thing in corporate-speak. Biological references concerning computers are very useful to people who have no technical knowledge and don't want any, because they are so vague the speaker can never be found wrong.

Re:Taking the analogy further...

[whisper_jeff]

but does anyone knows of a product that actually use such a principle for real?

Yes. Ants [sourceforge.net]

It's a p2p program that uses a similar principle to vastly increase user anonymity. Currently, the only downside of the program (that I've noticed) is that it is in such minimal usage. The ant-like functionality of it, however, is really quite intelligent.

Re:ridiculous references

[Jurily]

They are talking about an ant-based algorithm, often used in optimization (routing, for example).

I'm sorry, but neither you nor the article make any fucking sense whatsoever. This is an IT geek site, stop with the fucking metaphores. Why do these people expect us to understand "virtual ants wander around the network" any more than "a network scanner that looks for the same security holes as the worms, only this notifies the sysadmin about them"?

These are not the ants you are looking for...

[Scubaraf]

Ants are not a good analogy. What they are describing is much more like an adaptive immune system - the "ants" in their system are circulating T-cells. Dr. Rodney Langman, an immunologist from the Salk Institute and UCSD, proposed exactly what the article describes. He described the conceptual elements required to form a synthetic immune system in the early 90's. Initially the goal was to model and understand our own adaptive immunity, but he often used computers and network protection from viruses as examples when explaining the concepts. I was his TA while in grad school.

Synthetic Immunity [salk.edu]

If we extrapolate - computer networks will not only be guarded by T-cells that circulate through networks, identify threats, and release proinflammatory markers and antiviral "poisons" - there will be B-cell equivalents that produce antibodies, snippets of code the bind and immobilize specific codes they are designed to recognize. There will also be some degree of autoimmunity as viruses are reworked to mimic benign code. There will be an HIV equivalent (there already are) that targets not just the OS, but the OS defenses themselves. And there will be vaccines - benign code that presented as a virus to train the immune system on a specific type of threat.