Stochastic behavior of random constant scanning worms

Abstract

This paper discusses modeling and simulation issues associated with the stochastic behavior of a special type of a computer worm called a random constant scanning (RCS) worm. Although these worms propagate by randomly scanning network addresses to find hosts that are susceptible to infection, traditional RCS worm models are fundamentally deterministic. A density-dependent Markov jump process model for RCS worms is presented and analyzed. Conditions are shown for when worm models can safely ignore some stochastic properties of RCS worm propagation. A computationally simple hybrid deterministic/stochastic model for the observed scanning behavior on a local network due to the global propagation of an RCS scanning worm is also presented and discussed.