Analysing distributed Internet worm attacks using continuous state-space approximation of process algebra models

Abstract

Internet worms are classically described using SIR models and simulations, to capture the massive dynamics of the system. Here we are able to generate a differential equation-based model of infection based solely on the underlying process description of the infection agent model. Thus, rather than craft a differential equation model directly, we derive this representation automatically from a high-level process model expressed in the PEPA process algebra. This extends existing population infection dynamics models of Internet worms by explicitly using frequency-based spread of infection. Three types of worm attack are analysed which are differentiated by the nature of recovery from infection and vulnerability to subsequent attacks. To perform this analysis we make use of continuous state-space approximation, a recent breakthrough in the analysis of massively parallel stochastic process algebra models. Previous explicit state-representation techniques can only analyse systems of order 10 9 states, whereas continuous state-space approximation can allow analysis of models of 10 10 000 states and beyond.