Diurnal Forced Models for Worm Propagation Based on Conficker Dataset

Abstract

Due to the vulnerability of computer system, Internet worm is still greatly threatenning network security. It is found that the spread of worm regularly change because of the different space distributions of hosts and this phenomenon is defined as diurnal pattern. Based on diurnal pattern, two worm propagation models, namely simple diurnal forced model and complicated diurnal forced one, are constructed to describe and predict worm propagation. To verify the accuracy of them, Conficker dataset is adopted to obtain the practical curves of worm propagation. Through comparisons of numerical curves from models and practical curves, it is proved that simple model is good in describing the initial stage of worm propagation and complicated model can accurately predict the whole worm propagation.

Hybrid Epidemics—A Case Study on Computer Worm Conficker

“…• Neighbourhood spreading, where it probes computers in ten neighbouring LANs (with smaller consecutive IP address prefixes). Previous research on Conficker has studied the geographical distribution of infected IP addresses, the distribution of probing packet size [7,54,55], and properties of the worm's global probing [56,57]. The parameters of Conficker's hybrid spreading and how they affect the epidemic dynamics of the worm can help explain why the worm is so contagious.…”