Model and estimation of worm propagation under network partition

Abstract

Several worm propagation models have been proposed to describe the behavior of worms in order to find the weak link in the worm propagation for the purpose of further treatment measures. In this paper, we investigate the relation between worm spread and the scale of network. The partition-based model of worm propagation is developed, in which we focus on two key factors: the subnet number of the network to be partitioned into and the time to perform partition. Using a combination of analytic modeling and simulations, we describe how each of these two factors impacts the dynamics of worm epidemic. Based on our simulation experiment results, we propose the network partitioning approach to deescalate network scale and thus restrict the worm propagation in large scale networks. © Springer-Verlag Berlin Heidelberg 2006.