A model of the spread of randomly scanning Internet worms that saturate access links

Abstract

We present a simple, deterministic mathematical model for the spread of randomly scanning and bandwidth-saturating Internet worms. Such worms include Slammer and Witty, both of which spread extremely rapidly. Our model, consisting of coupled Kermack-McKendrick (a.k.a. stratified susceptibles-infectives (SI)) equations, captures both the measured scanning activity of the worm and the network limitation of its spread, that is, the effective scan-rate per worm/infective. The Internet is modeled as an ideal core network to which each peripheral (e.g., enterprise) network is connected via a single access link. It is further assumed in this note that as soon as a single end-system in the peripheral network is infected by the worm, the subsequent scanning of the rest of the Internet saturates the access link, that is, there is “instant” saturation. We fit our model to available data for the Slammer worm and demonstrate the model's ability to accurately represent Slammer's total scan-rate to the core.

References

1. Chen, Z., Gao, L., and Kwait, K. 2003. Modeling the spread of active worms. In Proceedings of IEEE INFOCOM (San Fransisco, CA).
2. Cooke, E., Bailey, M., Mao, Z., Watson, D., Jahanian, F., and McPherson, D. 2004. Toward understanding distributed blackhole placement. In Proceedings of ACM WORM (Washington, DC).
3. Daley, D. and Gani, J. 1999. Epidemic Modeling, an Introduction. Cambridge University Press, Cambridge, U.K.
4. Kesidis, G., Hamadeh, I., and Jiwasurat, S. 2005. Coupled Kermack-McKendrick models for randomly scanning and bandwidth saturating Internet worms. In Proceedings of QoS-IP. Springer-Verlag, Berlin, Germany.
5. Kurtz, T. 1981. Approximation of population processes. In Proceedings of the CBMS-NSF Regional Conference Series in Applied Mathematics. Vol. 36.
6. Li, L., Jiwasurat, S., Hamadeh, I., Kesidis, G., Neumann, C., and Liu, P. 2006. Emulating sequential scanning worms on the DETER testbed. In Proceedings of IEEE/Create-Net TridentCom. (Barcelona, Spain).
7. Liljenstam, M., Nicol, D., Berk, V., and Gray, R. 2003. Simulating realistic network worm traffic for worm warning system design and testing. In Proceedings of ACM WORM (Washington, DC).
8. Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S., and Weaver, N. 2003a. Inside the Slammer worm. IEEE Sec. Priv. 1, 4, 33--39.
9. Moore, D., Shannon, C., Voelker, G. M., and Savage, S. 2003b. Internet quarantine: Requirements for containing self-propagating code. In Proceedings of IEEE INFOCOM. (San Francisco, CA).
10. Staniford, S., Paxson, V., and Weaver, N. 2002. How to own the Internet in your spare time. In Proceedings of USENIX Security Symposium. 149--167.
11. Weaver, N., Hamadeh, I., Kesidis, G., and Paxson, V. 2004a. Preliminary results using scale-down to explore worm dynamics. In Proceedings of ACM WORM (Washington, DC).
12. Weaver, N., Staniford, S., and Paxson, V. 2004b. Very fast containment of scanning worms. In Proceedings of the 13th USENIX Security Symposium.
13. Zou, C., Gong, W., and Towsley, D. 2002. Code Red worm propagation modeling and analysis. In Proceedings of the 9th ACM Conference on Computer and Communication Security (CCS'02, Washington, DC).
14. Zou, C., Gong, W., and Towsley, D. 2003. Worm propagation modeling and analysis under dynamic quarantine defense. In Proceedings of the ACM CCS Workshop on Rapid Malcode (WORM'03, Washington, DC).

Index Terms

• Computer systems organization

  • Architectures

    • Distributed architectures

• Software and its engineering

  • Software organization and properties

    • Software system structures

      • Distributed systems organizing principles