Epidemiological modeling of network worm infections and countermeasures

Abstract

Fast spreading network worms continue to pose a threat to the Internet due to their virulence, speed and the continuous discovery of wormable vulnerabilities. Mathematical models for worm propagation can help us to understand the epidemiology of worm outbreaks and to devise effective defense mechanisms. In this paper, we report the epidemiological modeling and analysis of worm propagation and a distributed worm detection and prevention countermeasure. The work is based on the Slammer and Witty worm characteristics and employs the widely used Susceptible-Infected biological model. The epidemiological modeling shows that the SI model can be used to represent the virulence of random scanning worms and to quantify the effectiveness of worm countermeasures.