Coupled kermack-mckendrick models for randomly scanning and bandwidth-saturating internet worms

Authors:
George Kesidis;Ihab Hamadeh;Soranun Jiwasurat
Affiliations:
Department of Electrical Engineering, Department of Computer Science and Engineering, Pennsylvania State University, University Park, PA;Department of Computer Science and Engineering, Pennsylvania State University, University Park, PA;Department of Computer Science and Engineering, Pennsylvania State University, University Park, PA
Venue:
QoS-IP'05 Proceedings of the Third international conference on Quality of Service in Multiservice IP Networks
Year:
2005

Citing 8
Cited 7

Code red worm propagation modeling and analysis

Proceedings of the 9th ACM conference on Computer and communications security
How to Own the Internet in Your Spare Time

Proceedings of the 11th USENIX Security Symposium
Inside the Slammer Worm

IEEE Security and Privacy
Simulating realistic network worm traffic for worm warning system design and testing

Proceedings of the 2003 ACM workshop on Rapid malcode
Worm propagation modeling and analysis under dynamic quarantine defense

Proceedings of the 2003 ACM workshop on Rapid malcode
Toward understanding distributed blackhole placement

Proceedings of the 2004 ACM workshop on Rapid malcode
Preliminary results using scale-down to explore worm dynamics

Proceedings of the 2004 ACM workshop on Rapid malcode
Very fast containment of scanning worms

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13

Advanced Routing Worm and Its Security Challenges

Simulation
On the performance of internet worm scanning strategies

Performance Evaluation
Modeling and Simulation Study of the Propagation and Defense of Internet E-mail Worms

IEEE Transactions on Dependable and Secure Computing
A model of the spread of randomly scanning Internet worms that saturate access links

ACM Transactions on Modeling and Computer Simulation (TOMACS)
On the race of worms, alerts, and patches

IEEE/ACM Transactions on Networking (TON)
Honeypot detection in advanced botnet attacks

International Journal of Information and Computer Security
Maximum damage malware attack in mobile wireless networks

IEEE/ACM Transactions on Networking (TON)

Quantified Score

Hi-index	0.00

Visualization

Abstract

We present a simple, deterministic mathematical model for the spread of randomly scanning and bandwidth-saturating Internet worms. Such worms include Slammer and Witty, both of which spread extremely rapidly. Our model, consisting of coupled Kermack-McKendrick equations, captures both the measured scanning activity of the worm and the network limitation of its spread, i.e., the effective scan-rate per worm/infective. We fit our model to available data for the Slammer worm and demonstrate its ability to accurately represent Slammer's total scan-rate to the core.