A Probabilistic Population Study of the Conficker-C Botnet

We estimate the number of active machines per hour infected with the Conficker-C worm, using a probability model of Conficker-C's UDP P2P scanning behavior. For an observer with access to a proportion of monitored IPv4 space, we derive the distribution of the number of times a single infected host is observed scanning the monitored space, based on a study of the P2P protocol, and on network and behavioral variability by relative hour of the day. We use these distributional results in conjunction with the L

• Type: Conference
• Year: 2010
• Where: PAM
• Authors: Rhiannon Weaver
• Keywords: Central Limit Theorem, Computer Networks, P2P Scanning Behavior, PAM 2010, Probability Models