Efficient simulation of Internet worms

  • Authors:
  • David M. Nicol

  • Affiliations:
  • University of Illinois at Urbana-Champaign, Urbana, IL

  • Venue:
  • ACM Transactions on Modeling and Computer Simulation (TOMACS)
  • Year:
  • 2008

Quantified Score

Hi-index 0.00

Visualization

Abstract

Simulation of Internet worms (and other malware) requires tremendous computing resources when every packet generated by the phenomena is modeled individually; on the other hand, models of worm growth based on differential equations lack the significant variability inherent in worms that sample targets randomly. This article addresses the problem with a model that focuses on times of infection. We propose a hybrid discrete-continuous model that minimizes execution time subject to an accuracy constraint on variance. We also develop an efficiently executed model of preferential random scanning and use it to investigate the sensitivity of worm propagation speed to the distribution of susceptible hosts through the network, and to the local preference probability. Finally, we propose and study two optimizations to a fluid-based simulation of scan traffic through a backbone network, observing an order-of-magnitude improvement in execution speed.