Preliminary results using scale-down to explore worm dynamics

A major challenge when attempting to analyze and model large-scale Internet phenomena such as the dynamics of global worm propagation is finding ate abstractions that allow us to tractably grapple with size of the artifact while still capturing its most salient properties. We present initial results from investigating "scaledown" techniques for approximating global Internet worm dynamics by shrinking the effective size of the network under study. We explore scaledown in the context of both simulation and analysis, using as a calibration touchstone an attempt to reproduce the empirically observed behavior of the Slammer worm, which exhibited a peculiar decline in average per-worm scanning rate not seen in other worms (except for the later Witty worm, which exhibited similar propagation dynamics). We develop a series of abstract models approximating Slammer's Internet propagation and demonstrate that such modeling appears to require incorporating both heterogeneous cluste...

• Type: Conference
• Year: 2004
• Where: WORM
• Authors: Nicholas Weaver, Ihab Hamadeh, George Kesidis, Vern Paxson
• Keywords: Global Worm Propagation, Internet Worm Dynamics, Security Privacy, Worm, WORM 2004