Model and Estimation of Worm Propagation Under Network Partition

  • Ping Wang
  • Binxing Fang
  • Xiaochun Yun
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3903)


Several worm propagation models have been proposed to describe the behavior of worms in order to find the weak link in the worm propagation for the purpose of further treatment measures. In this paper, we investigate the relation between worm spread and the scale of network. The partition-based model of worm propagation is developed, in which we focus on two key factors: the subnet number of the network to be partitioned into and the time to perform partition. Using a combination of analytic modeling and simulations, we describe how each of these two factors impacts the dynamics of worm epidemic. Based on our simulation experiment results, we propose the network partitioning approach to deescalate network scale and thus restrict the worm propagation in large scale networks.


Infected Host Large Scale Network Network Scale Network Partition Worm Propagation 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Moore, D., Shannon, C., Claffy, K.: Code Red: A case study on the spread and victims of an Internet worm. In: Proceedings of the 2nd ACM SIGCOMM Workshop on Internet Measurement, pp. 273–284 (2002)Google Scholar
  2. 2.
    Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S., Weaver, N.: Inside the slammer worm. IEEE Magazine of Security and Privacy 1(4), 33–39 (2003)CrossRefGoogle Scholar
  3. 3.
    Wen, W.P., Qing, S.H., Jiang, J.C., Wang, Y.J.: Research and Development of Internet Worm. Journal of Software 15(8), 1208–1219 (2004)MATHGoogle Scholar
  4. 4.
    Zou, C.C., Gao, L., Gong, W., Towsley, D.: Monitoring and Early Warning for Internet- Worms. In: Proceedings of the 10th ACM Conference on Computer and Communication Security, pp. 190–199 (2003)Google Scholar
  5. 5.
    Moore, D., Shannon, C., Voelker, G.M., Savage, S.: Internet quarantine: requirements for containing self-propagating code. In: INFOCOM 2003. Twenty-Second Annual Joint Conference of the IEEE Computer and Communications Societies, 30 March-3 April, vol. 3, pp. 1901–1910. IEEE, Los Alamitos (2003)Google Scholar
  6. 6.
    Hung, J.C., Lin, K.-C., Chang, A.Y., Lin, N.H., Lin, L.H.: A Behavior-based Anti- Worm System. In: International Conference on Advanced Information Networking and Applications (AINA 2003), pp. 812–815 (2003)Google Scholar
  7. 7.
    Morrison. Honeypot technology. (2001)
  8. 8.
    Streftaris, G., Gibson, G.J.: Statistical inference for stochastic epidemic models. In: Proc. of the 17th International Workshop on Statistical Modelling, Chania, pp. 609–616 (2002)Google Scholar
  9. 9.
    Frauenthal, J.: Mathematical Modeling in Epidemiology. Springer, New York (1980)MATHGoogle Scholar
  10. 10.
    Wang, Y., Wang, C.X.: Modeling the effects of timing parameters on virus propagation. In: Proc. of the ACM CCS Workshop on Rapid Malcode (WORM 2003), p. 7 (2003)Google Scholar
  11. 11.
    SSFNET. Modeling the Global Internet,

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Ping Wang
    • 1
  • Binxing Fang
    • 1
  • Xiaochun Yun
    • 1
  1. 1.Dept. of Computer Science and TechnologyHarbin Institute of TechnologyHeilongjiang HarbinChina

Personalised recommendations