Preliminary results using scale-down to explore worm dynamics

Nicholas Weaver, Ihab Hamadeh, George Kesidis, Vern Paxson

Research output: Chapter in Book/Report/Conference proceedingConference contribution

43 Scopus citations


A major challenge when attempting to analyze and model large-scale Internet phenomena such as the dynamics of global worm propagation is finding appropriate abstractions that allow us to tractably grapple with size of the artifact while still capturing its most salient properties. We present initial results from investigating "scaledown" techniques for approximating global Internet worm dynamics by shrinking the effective size of the network under study. We explore scaledown in the context of both simulation and analysis, using as a calibration touchstone an attempt to reproduce the empirically observed behavior of the Slammer worm, which exhibited a peculiar decline in average per-worm scanning rate not seen in other worms (except for the later Witty worm, which exhibited similar propagation dynamics). We develop a series of abstract models approximating Slammer's Internet propagation and demonstrate that such modeling appears to require incorporating both heterogeneous clustering of infectibles and heterogeneous access-link bandwidths connecting those clusters to the Internet core. We demonstrate the viability of scaledown but also explore two important artifacts it introduces: heightened variability of results, and biasing the worm towards earlier propagation.

Original languageEnglish (US)
Title of host publicationWORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode
PublisherAssociation for Computing Machinery
Number of pages8
ISBN (Print)1581139705, 9781581139709
StatePublished - 2004
EventWORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode - Washington, DC, United States
Duration: Oct 29 2004Oct 29 2004

Publication series

NameWORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode


OtherWORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode
Country/TerritoryUnited States
CityWashington, DC

All Science Journal Classification (ASJC) codes

  • General Engineering


Dive into the research topics of 'Preliminary results using scale-down to explore worm dynamics'. Together they form a unique fingerprint.

Cite this