title: Hybrid epidemics--a case study on computer worm conficker.
abstract: Conficker is a computer worm that erupted on the Internet in 2008. It is unique in combining three different spreading strategies: local probing, neighbourhood probing, and global probing. We propose a mathematical model that combines three modes of spreading: local, neighbourhood, and global, to capture the worm's spreading behaviour. The parameters of the model are inferred directly from network data obtained during the first day of the Conficker epidemic. The model is then used to explore the tradeoff between spreading modes in determining the worm's effectiveness. Our results show that the Conficker epidemic is an example of a critically hybrid epidemic, in which the different modes of spreading in isolation do not lead to successful epidemics. Such hybrid spreading strategies may be used beneficially to provide the most effective strategies for promulgating information across a large population. When used maliciously, however, they can present a dangerous challenge to current internet security protocols.
authors.affiliation: Department of Computer Science, University College London, London, United Kingdom; Security Science Doctoral Research Training Centre, University College London, London, United Kingdom.
authors.forename: Changwang
authors.initials: C
authors.lastname: Zhang
authors.affiliation: Department of Computer Science, University College London, London, United Kingdom.
authors.forename: Shi
authors.initials: S
authors.lastname: Zhou
authors.affiliation: Division of Infection and Immunity, University College London, London, United Kingdom.
authors.forename: Benjamin M
authors.initials: BM
authors.lastname: Chain
mesh_terms: D016494:Computer Security; D058872:Epidemics; D020407:Internet; D008962:Models, Theoretical