Distributed Worm Simulation with a Realistic Internet Model

Internet worm spread is a phenomenon involving millions of hosts, who interact in complex and diverse environment. Scanning speed of each infected host depends on its resources and the defenses at work in its network. Aggressive worms further interact with the underlying Internet topology − the dynamics of the spread is constrained by the limited bandwidth of network links, and high-volume scan traffic leads to BGP router failure thus affecting global routing. Worm traffic also interacts with legitimate background traffic competing for (and often winning) the limited bandwidth resources. To faithfully simulate worm spread and other Internet-wide events such as DDoS, flash crowds and spam we need a detailed Internet model, a packet-level simulation of relevant event features, and a realistic model of background traffic on the whole Internet. The memory and CPU requirements of such simulation exceed a single machine’s resources, creating a need for distributed simulation. We propose...

• Type: Conference
• Year: 2005
• Where: PADS
• Authors: Songjie Wei, Jelena Mirkovic, D. Martin Swany
• Keywords: Internet Worm Spread, Limited Bandwidth, Modelling And Simulation, PADS 2005, Worm Spread