Hybrid Epidemics—A Case Study on Computer Worm Conficker

Abstract

Conficker is a computer worm that erupted on the Internet in 2008. It is unique in combining three different spreading strategies: local probing, neighbourhood probing, and global probing. We propose a mathematical model that combines three modes of spreading: local, neighbourhood, and global, to capture the worm’s spreading behaviour. The parameters of the model are inferred directly from network data obtained during the first day of the Conficker epidemic. The model is then used to explore the tradeoff between spreading modes in determining the worm’s effectiveness. Our results show that the Conficker epidemic is an example of a critically hybrid epidemic, in which the different modes of spreading in isolation do not lead to successful epidemics. Such hybrid spreading strategies may be used beneficially to provide the most effective strategies for promulgating information across a large population. When used maliciously, however, they can present a dangerous challenge to current internet security protocols.

Optimizing Hybrid Spreading in Metapopulations

“…Our study reveals that, in metapopulations, there exists an optimal tradeoff between global and local spreading, and provides a way to calculate this optimum given information on other epidemic parameters. These results are supported by our recent study 32 on measurement data of the Internet worm Conficker 5 33 34 .…”

A New Class of Activation Functions Based on the Correcting Amendments of Gompertz–makeham Type

“…After the substitution t = kl cos θ + a, where k = 2π λ , λ is the wave length; b is the phase difference; θ is the azimuthal angle; l is the distance between the emitters (l = λ 2 is fixed), the activation function ϕ 0 (θ) has a form of emitting chart of antenna factor. [37], [38] collected on November 21, 2008. We will approximate the number of infected nodes I(t), see Fig.…”

“…Figure9: Numbers of susceptible nodes S(t), infected nodes I(t) and recovered nodes R(t) as a function of time t, as inferred from CAIDA's dataset on 21/Nov/ 2008, the day of Conficker's outbreak[37].…”

On a ''Type I Half-logistic Modified Weibull'' Model: Some Extended Models and Applications

“…Some Applications. Here we will present a new analysis of Conficker propagation in 2008 and we explore the Network Telescope project's daily dataset[4],[5] collected onNovember 21, 2008. …”