Heterogeneity in vulnerable hosts slows down worm propagation

Abstract

Worm attacks continue to be a significant threat to the Internet and have been a main tool used by botnets to recruit bots. Worm propagation models are important for understanding worm dynamics and designing effective and efficient detection and defense systems. The existing models, however, ignore the heterogeneity in vulnerable hosts and assume that the worm-scanning rate is the same for all infected hosts. In this work, we analytically and empirically study the impact of heterogeneity of vulnerable hosts on worm propagation. Specifically, we first apply the Jensen's inequality to show that the heterogeneity in vulnerable hosts indeed hinders the speed of worm propagation. We then conjecture, through the approximation analysis, that if the degree of the heterogeneity in vulnerable hosts is higher, the worm spreads slower. Next, we propose a novel model to predict and characterize worm dynamics among heterogeneous vulnerable hosts. Finally, applying the scale-down simulations and simulating the propagation of a Witty-like worm in the Internet, we verify our analytical results and demonstrate that our proposed model can accurately predict the spread of worms among heterogeneous vulnerable hosts.