Analysis of the propagation pattern of a worm with random scanning strategy based on usage rate of network bandwidth

Abstract

There have been many studies on modeling the propagation patterns of Internet worms since the advent of Morris worm. Among them, there is a well defined propagation model, which is generally called random constant spread (RCS) model. However, there are some limitations to model the propagation patterns of new emergent Internet worms with the RCS model because the model uses the only number of infected hosts as the factor of a worm's propagation. The new worms have several considerable characteristics: utilization of a faster scanning strategy, miniaturization of the size of a worm's propagation packet, denial of service by network saturation, and maximum damage before human-mediated responses. These characteristics make it difficult to notice much harder than before whether a worm propagates itself or not. Therefore, a basic factor instead of the number of infected hosts, which is used by the RCS model, is required to model the propagation patterns of new worms. In this paper, only analysis and simulation results based on usage rate of network bandwidth, which can be considered as a basic factor, are presented about the propagation pattern of a worm with random scanning strategy. Miniaturization of the size of a propagation packet and utilization of a faster scanning strategy are related to the size of worm's propagation packet and its propagation rate, respectively. It is presented that the latter is more sensitive than the former. © 2010 Springer-Verlag.