1. Modeling the spread of active worms Zesheng Chen, Lixin Gao, and Kevin Kwiat bearhsu - INFOCOM 2003

2. Outline Introduction Modeling the Spread of Active Worms Applications of the AAWP Model Conclusions

3. Outline Introduction Modeling the Spread of Active Worms Applications of the AAWP Model Conclusions

4. Aims of this paper Analytical Active Worm Propagation (AAWP) model Answer 3 questions: How to monitor the spread accurately How to detect the spread in a timely fashion How to defend against the spread effectively

5. Active Worms On the Internet, active worms infect computers and use infect computers in an automated fashion Code Red, Nimda, Morris worms, etc.

6. How active worms spread

7. Parameters while spreading Parameters Notation Explanation # of vulnerable machines NThe number of vulnerable machines Size of hitlisthThe number of infected machines at the beginning of the spread of active worms Scanning ratesThe average number of machines scanned by an infected machine per unit time Death ratedThe rate a which an infection is detected on a machine and eliminated Patching ratepThe rate at which an infected or vulnerable machine becomes invulnerable

8. Outline Introduction Modeling the Spread of Active Worms Applications of the AAWP Model Conclusions

9. AAWP model (1/2) There are m i vulnerable machines and n i infected machines at time i After time i, newly infected hosts will be While n 0 = h and i ≥ 0, there are (d+p)n i hosts become invulnerable or uninfected, so

10. Influence of infecting period Influence of patching rate Influence of hitlist size AAWP model (2/2)

11. Epidemic model The monitoring and early detection of Internet worms, 2005 IEEE INFOCOM

12. AAWP vs. Epidemical model (1) Discrete vs. Continuous time AAWP is more accurate because a host can ’ t infect others when it ’ s completely infected Something that AAWP considers while epidemical model doesn ’ t: Patching rate The time that a worm takes to infect a machine The condition that the worm can infect the same destination at the same time

13. AAWP vs. Epidemical model (2)

14. Simulating “ Code Red v2 ”

15. Outline Introduction Modeling the Spread of Active Worms Applications of the AAWP Model Monitoring the spread of active worms Detection speed Effective of the defense system Conclusions

16. Monitoring the spread of active worms If we monitor “ 32- l ” bits of IP ’ s, then the probability that an infected machine can be observed is:

17. Detection speed

18. Effectiveness of defense system

19. Outline Introduction Modeling the Spread of Active Worms Applications of the AAWP Model Conclusions

20. Presenting an “ AAWP ” model, which gives more realistic results than Epidemical model does The mentioned 3 questions are answered 2 20 ~2 24 IP ’ s are large enough to obtain realistic results 2 18 IP address are needed to detect the Code Red v2 like worms in 1 hour To defend against the Code Red v2 like worms, we need 2 18 IP addresses, by using LaBrea system