Preliminary results using scale-down to explore worm dynamics

Nicholas Weaver, Ihab Hamadeh, George Kesidis, Vern Paxson

Research output: Chapter in Book/Report/Conference proceedingConference contribution

37 Citations (Scopus)

Abstract

A major challenge when attempting to analyze and model large-scale Internet phenomena such as the dynamics of global worm propagation is finding appropriate abstractions that allow us to tractably grapple with size of the artifact while still capturing its most salient properties. We present initial results from investigating "scaledown" techniques for approximating global Internet worm dynamics by shrinking the effective size of the network under study. We explore scaledown in the context of both simulation and analysis, using as a calibration touchstone an attempt to reproduce the empirically observed behavior of the Slammer worm, which exhibited a peculiar decline in average per-worm scanning rate not seen in other worms (except for the later Witty worm, which exhibited similar propagation dynamics). We develop a series of abstract models approximating Slammer's Internet propagation and demonstrate that such modeling appears to require incorporating both heterogeneous clustering of infectibles and heterogeneous access-link bandwidths connecting those clusters to the Internet core. We demonstrate the viability of scaledown but also explore two important artifacts it introduces: heightened variability of results, and biasing the worm towards earlier propagation.

Original languageEnglish (US)
Title of host publicationWORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode
Pages65-72
Number of pages8
StatePublished - Dec 1 2004
EventWORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode - Washington, DC, United States
Duration: Oct 29 2004Oct 29 2004

Publication series

NameWORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode

Other

OtherWORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode
CountryUnited States
CityWashington, DC
Period10/29/0410/29/04

Fingerprint

Internet
Telecommunication links
Calibration
Scanning
Bandwidth

All Science Journal Classification (ASJC) codes

  • Engineering(all)

Cite this

Weaver, N., Hamadeh, I., Kesidis, G., & Paxson, V. (2004). Preliminary results using scale-down to explore worm dynamics. In WORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode (pp. 65-72). (WORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode).
Weaver, Nicholas ; Hamadeh, Ihab ; Kesidis, George ; Paxson, Vern. / Preliminary results using scale-down to explore worm dynamics. WORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode. 2004. pp. 65-72 (WORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode).
@inproceedings{5518d54d511d4dd183028152f3230551,
title = "Preliminary results using scale-down to explore worm dynamics",
abstract = "A major challenge when attempting to analyze and model large-scale Internet phenomena such as the dynamics of global worm propagation is finding appropriate abstractions that allow us to tractably grapple with size of the artifact while still capturing its most salient properties. We present initial results from investigating {"}scaledown{"} techniques for approximating global Internet worm dynamics by shrinking the effective size of the network under study. We explore scaledown in the context of both simulation and analysis, using as a calibration touchstone an attempt to reproduce the empirically observed behavior of the Slammer worm, which exhibited a peculiar decline in average per-worm scanning rate not seen in other worms (except for the later Witty worm, which exhibited similar propagation dynamics). We develop a series of abstract models approximating Slammer's Internet propagation and demonstrate that such modeling appears to require incorporating both heterogeneous clustering of infectibles and heterogeneous access-link bandwidths connecting those clusters to the Internet core. We demonstrate the viability of scaledown but also explore two important artifacts it introduces: heightened variability of results, and biasing the worm towards earlier propagation.",
author = "Nicholas Weaver and Ihab Hamadeh and George Kesidis and Vern Paxson",
year = "2004",
month = "12",
day = "1",
language = "English (US)",
isbn = "1581139705",
series = "WORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode",
pages = "65--72",
booktitle = "WORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode",

}

Weaver, N, Hamadeh, I, Kesidis, G & Paxson, V 2004, Preliminary results using scale-down to explore worm dynamics. in WORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode. WORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode, pp. 65-72, WORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode, Washington, DC, United States, 10/29/04.

Preliminary results using scale-down to explore worm dynamics. / Weaver, Nicholas; Hamadeh, Ihab; Kesidis, George; Paxson, Vern.

WORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode. 2004. p. 65-72 (WORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

TY - GEN

T1 - Preliminary results using scale-down to explore worm dynamics

AU - Weaver, Nicholas

AU - Hamadeh, Ihab

AU - Kesidis, George

AU - Paxson, Vern

PY - 2004/12/1

Y1 - 2004/12/1

N2 - A major challenge when attempting to analyze and model large-scale Internet phenomena such as the dynamics of global worm propagation is finding appropriate abstractions that allow us to tractably grapple with size of the artifact while still capturing its most salient properties. We present initial results from investigating "scaledown" techniques for approximating global Internet worm dynamics by shrinking the effective size of the network under study. We explore scaledown in the context of both simulation and analysis, using as a calibration touchstone an attempt to reproduce the empirically observed behavior of the Slammer worm, which exhibited a peculiar decline in average per-worm scanning rate not seen in other worms (except for the later Witty worm, which exhibited similar propagation dynamics). We develop a series of abstract models approximating Slammer's Internet propagation and demonstrate that such modeling appears to require incorporating both heterogeneous clustering of infectibles and heterogeneous access-link bandwidths connecting those clusters to the Internet core. We demonstrate the viability of scaledown but also explore two important artifacts it introduces: heightened variability of results, and biasing the worm towards earlier propagation.

AB - A major challenge when attempting to analyze and model large-scale Internet phenomena such as the dynamics of global worm propagation is finding appropriate abstractions that allow us to tractably grapple with size of the artifact while still capturing its most salient properties. We present initial results from investigating "scaledown" techniques for approximating global Internet worm dynamics by shrinking the effective size of the network under study. We explore scaledown in the context of both simulation and analysis, using as a calibration touchstone an attempt to reproduce the empirically observed behavior of the Slammer worm, which exhibited a peculiar decline in average per-worm scanning rate not seen in other worms (except for the later Witty worm, which exhibited similar propagation dynamics). We develop a series of abstract models approximating Slammer's Internet propagation and demonstrate that such modeling appears to require incorporating both heterogeneous clustering of infectibles and heterogeneous access-link bandwidths connecting those clusters to the Internet core. We demonstrate the viability of scaledown but also explore two important artifacts it introduces: heightened variability of results, and biasing the worm towards earlier propagation.

UR - http://www.scopus.com/inward/record.url?scp=14944358991&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=14944358991&partnerID=8YFLogxK

M3 - Conference contribution

AN - SCOPUS:14944358991

SN - 1581139705

SN - 9781581139709

T3 - WORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode

SP - 65

EP - 72

BT - WORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode

ER -

Weaver N, Hamadeh I, Kesidis G, Paxson V. Preliminary results using scale-down to explore worm dynamics. In WORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode. 2004. p. 65-72. (WORM'04 - Proceedings of the 2004 ACM Workshop on Rapid Malcode).