title: An epidemiological model of internet worms with hierarchical dispersal and spatial clustering of hosts.
abstract: Beginning in 2001, many instances of malicious software known as Internet worms have been using biological strategies such as hierarchical dispersal to seek out and spread to new susceptible hosts more efficiently. We measured the distribution of potentially susceptible hosts in the space of Internet addresses to determine their clustering. We have used the results to construct a full-size simulated Internet with 232hosts with mean and variance of susceptible hosts chosen to match our measurements at multiple spatial scales. Epidemiological simulations of outbreaks among the roughly 2.8×106susceptible hosts on this full-sized network show that local preference scanning greatly increases the chances for an infected host to locate and infect other susceptible hosts by a factor of as much as several hundred. However, once deploying this strategy, the overall success of a worm is relatively insensitive to the details of its dispersal strategy over a wide range of parameters. In addition, although using localized interactions may allow malicious software to spread more rapidly or to more hosts on average, it can also lead to increased variability in infection levels among replicate simulations. Using such dispersal strategies may therefore be a high risk, high reward strategy for the authors of such software.
authors.affiliation: Department of Mathematics and Statistics, University of Maine, Orono, ME 04469, United States. Electronic address: hiebeler@math.umaine.edu.
authors.forename: David E
authors.initials: DE
authors.lastname: Hiebeler
authors.affiliation: Department of Mathematics and Statistics, University of Maine, Orono, ME 04469, United States; Bangor High School, Bangor, ME 04401, United States.
authors.forename: Andrew
authors.initials: A
authors.lastname: Audibert
authors.affiliation: School of Computing and Information Science, University of Maine, Orono, ME 04469, United States; College of Information and Computer Sciences, University of Massachusetts Amherst, Amherst, MA 01003, United States.
authors.forename: Emma
authors.initials: E
authors.lastname: Strubell
authors.affiliation: Department of Mathematics and Statistics, University of Maine, Orono, ME 04469, United States; Department of Statistics, North Carolina State University, Raleigh, NC 27695, United States.
authors.forename: Isaac J
authors.initials: IJ
authors.lastname: Michaud
mesh_terms: D016494:Computer Security; D020407:Internet; D008962:Models, Theoretical; D012984:Software
keywords: Malicious software; Network models