The effect of datagram size and susceptible population on the epidemiology of fast self-propagating malware

Abstract

The cost of a security event caused by fast self-propagating malware (a worm) has been estimated to be up to US$2.6 billion. Additionally, network malware outbreaks have been observed that spread at a significant pace across the global internet, with an observed infection level of more than 90 percent of vulnerable hosts within 10 minutes. The threat posed by such fast-spreading malware is therefore significant, particularly given the fact that network operator / administrator intervention is not likely to take effect within the typical epidemiological timescale of such malware infections. The internet worm simulator (IWS) is a finite state machine (FSM) based simulator capable of simulating the largescale epidemiology of fast self-propagating malware. Deterministic mathematical models require significantly less computation, however, lack the detail of FSM based simulation. This article focusses on the effect of common worm attributes on the contact coefficient of an SI model. The trends observed are presented, and their impact discussed. It is intended that this work can be used by researchers and professionals, to aid their understanding of large-scale worm outbreaks.