Conference · 2010
Blueprints for a Large-Scale Early Warning System
Paul G. Spirakis, Vasileios Vlachos, Vassilios Karakoidas, Dimitrios Liappis, Dimitrios Kalaitzis, Eftychios Valeontis, Spyros Kollias, George Argyros
The design and first prototype of PROTOS, an early warning system that treats ordinary personal computers as malware sensors — reading what their existing firewalls and antivirus already block, and aggregating it into a picture of global activity.
- Published in
- Proceedings of 14th Panhelenic Conference on Informatics (PCI 2010), 2010
- Citations
- 2 on Google Scholar, read 5 September 2026 — 26 of 30 by count
- Cite as
- SVK10
The idea
Modern malcode mutates faster than signatures can be written and distributed, so detection alone will not close the gap; proactive measurement is needed. The insight PROTOS builds on is that the heterogeneity of ordinary users' machines is itself a sensor network: a system not vulnerable to a given attack will refuse and log the attempt, and a large number of such refusals, collected and analysed, reveals activity at an early stage. No new agent has to inspect anything — the security software already installed is doing the observing.
Contributions
- The architecture and implementation of a large-scale early warning system that gathers intelligence from a large number of personal computers acting as sensors.
- Prediction mechanisms over the aggregated data, producing an estimate of global malware activity.
- A deployment plan with real scale behind it: the first version was to run on the Greek National School Network, reaching more than 100,000 students and teachers, with a later version open to all internet users.
Written from the paper itself — the PDF linked above, which this site hosts.