Characterising heterogeneity in vulnerable hosts on worm propagation

Abstract

Worm propagation models are important for understanding worm dynamics and designing effective and efficient detection and defence systems. The existing models, however, ignore the heterogeneity in vulnerable hosts and assume that the worm-scanning rate is the same for all infected hosts. In this work, we analytically and empirically study the impact of heterogeneity of vulnerable hosts on worm propagation. Specifically, we first apply the Jensen's inequality to show that the heterogeneity in vulnerable hosts indeed hinders the speed of worm propagation. Next, we propose a novel model to predict and characterise worm dynamics among heterogeneous vulnerable hosts. Finally, applying the real trace from Center for Applied Internet Data Analysis CAIDA to simulate the propagation of a Witty worm in the Internet, we verify our analytical results and demonstrate that our proposed model can accurately predict the spread of worms among heterogeneous vulnerable hosts.