Analysis of a scanning model of worm propagation

The traditional approach to modeling of internet worm propagation is to adopt a mathematical model, usually inspired by modeling of the spread of infectious diseases, describing the expected number of hosts infected as a function of the time since the start of infection. The predictions of such a model are then used to evaluate, improve, or develop defense and containment strategies against worms. However, a proper and complete understanding of worm propagation goes well beyond the mathematical formula given by the chosen model for the expected number of hosts infected at a given time. Thus, questions such as fitting the model, assessing the extent to which a specific realization of a worm spread may differ from the model’s predictions, behavior of the time points at which infections occur, and the estimation and effects of misspecification of model’s parameters must also be considered. In this paper, we address such questions for the well-known random constant spread (RCS) model of worm propagation. We first generalize the RCS model to our nonhomogeneous random scanning (NHRS) model. The NHRS model allows the worm’s contact rate to vary during worm propagation and it thus captures far more situations of interest than the RCS model which assumes a scanning rate constant in time. We consider the problem of fitting these models to empirical data and give a simulation procedure for a RCS epidemic. We also show how to obtain a confidence interval for the unknown contact rate in the RCS model. In addition, the use of prior information about the contact rate is discussed. The results and methodologies of this paper illuminate the structure and application of NHRS and RCS models of worm propagation.