This research developed a system, Rx, to provide early identification and effective control of network stealth worms in digital networks through techniques based on biological epidemiology. Network stealth worms comprise a class of surreptitious, self-propagating code that spread over network connections by exploiting security vulnerabilities in hosts. Past outbreaks due to traditional worms subverted hundreds of thousands of machines. Network stealth worms exacerbate that threat by using clandestine methods to maintain a persistent presence in the network. Biological epidemiology was shown to support the real-time detection, characterization, forecasting, and containment of network stealth worms. Epidemiology describes a scientific methodology in biology that seeks to understand, explain, and control disease. Bio-mathematical modeling led to the development of a mechanism for digital networks to identify worm infection behavior buried in anomaly data, to characterize a worm, and to forecast the temporal spread of a worm. Demographic analysis of the infected hosts revealed the subset of vulnerable machines within the population. The automated response of advanced quarantine used this information to control the spread of an identified worm by isolating both infected and vulnerable machines. The novel contributions of this research included the identification of a network stealth worm at the network-level based on end-host reports while simultaneously characterizing and forecasting the spread of the worm. Additionally, this task offered the technique of advanced quarantine through demographic analysis of the population. This work resulted in a scalable, fault-tolerant strategy that dramatically enhanced the survival rate of network hosts under attack by a stealth worm. Moreover, this approach did not require new hardware, changes to existing protocols, or participation outside the implementing organization. This research showed application to a wider range of challenges. The bio-mathematical models are extensible, allowing Rx to respond to variations on the self-propagating code presented here. The approach is applicable to other forms of malware beyond self-propagating code by interchanging the epidemic model with one more appropriate. Lastly, the strategy allowed anomaly detectors to be sensitive to lower reporting thresholds and a variety of often benign yet potentially useful events. / Ph. D.

Les protéines sont des objets biologiques conçus pour résister aux perturbations et, àen même temps, s'adapter à des nouveaux environnements et des nouveaux besoins. Que sont lespropriétés structurelles des protéines permettant une telle plasticité? Pour taclercette question, nous modélisons d'abord la structure des protéines comme un réseau d'acides aminés et atomes en interaction. Compte tenu de la conformation structurelle 3Dd'une mutation obtenue In Silico, une approche réseaupermet la quantification de son changement structurel. En utilisant des grands ensemblesde mutations, nous avons conclu que le changement structurel est indépendant du type d'acide aminé remplacé ou du remplacement après mutation. En regardantà la composition des voisinages d'acides aminés, nous avons remarqué que lela localisation d'un type d'acide aminé dans la structure 3D est arbitraire:ce qui signifie que les contraintes d'interactions d'acides aminés dans une protéinemontre être indépendantes de la position de l'acide aminé en question. Menant à laobservation que la position de l'acide aminé dans la séquence est lapropriété unique modulant la plasticité structurelle.Le fait que les acides aminés peuvent se remplacer les uns les autres danstoutes les positions parce que la contrainte d'interaction ne dépend pas dutype d'acide aminé,est basé sur la personnalisation des voisins viamutations altérnatives compensatoires. Même s'il y a une grandetolérance pour les mutations basée sur la robustesse structurelle, les mutations peuvent avoir un impact surla plasticité structurelle en raison de la modification de la force des interactions êntre acides aminéset la distribution des atomes et des voisins entourant les résidus.La conséquence directe d'une telle variabilité de l'emballage atomique,est dû à une différence de vide (espace vide,pas d'atomes) sur la surface des résidus identifiés par certaines de mes données / résultats.Cela soulève la possibilité que la plasticité structurelle n'est pas seulementrégulée par les acides aminés et les contacts atomiques, mais aussi en sculptantdes vides locales dans la structure de la protéine pour permettre des mouvements atomiquesnécessaires pour la fonction de la protéine. Enfin, pour tester cette hypothèse, nous avonsmis en œuvre trois algorithmes pour mesurer l'espace vide autour desacides aminés pour regarder la relation entre cet espace vide et la plasticité structurelle. / Proteins are biological objects made to resist perturbations and, atthe same time, adapt to new environments and new needs. What are thestructural properties of proteins allowing such plasticity? To tacklethis question we first model protein structure as a network of aminoacids and atoms in interaction. Given the 3D structural conformationof a mutation obtained In Silico, a network approachallows the quantification of its structural change. Using large setsof mutations, we concluded that structural change is independent fromthe type of amino acid replaced, or replacing after mutation. Lookingat the composition of amino acid neighborhoods, we noticed that thelocation of a type of amino acid in the 3D structure is arbitrary:meaning that constraints of amino acid interactions in a proteinshow to be position independent. Leading to theobservation that the position of the amino acid in the sequence is thesingle property modulating structural plasticity.The fact that amino acids can replace each other atany position because the interaction constraint is not dependent on thetype of amino acid,is based on the customization of neighbors via alternative amino acidmutations or compensatory mutations. Even if there is a large mutationtolerance based on structural robustness, mutations can have an impact onthe structural plasticity because of the change in strength of pairwsie interactionsand the distribution of atoms and neihgbors surrounding residues.The direct consequence of such a variable atomic packingdistribution, is a difference of void (empty space,no atoms) on the surface of residues as identified by some of my data/results.This raises the possibility that structural plasticity is not onlyregulated by amino acid and atomic contacts but also by carving localvoids within the protein structure to allow atomic motionsrequired for the function of the protein. Finally, to test this hypothesis, we haveimplemented three algorithms to measure the empty space around aminoacids to look at the relation between this empty space and structural plasticity.