Hybrid epidemics--a case study on computer worm conficker.

Changwang Zhang,Benjamin M Chain,Shi Zhou

doi:10.1371/journal.pone.0127478

Abstract

Conficker is a computer worm that erupted on the Internet in 2008. It is unique in combining three different spreading strategies: local probing, neighbourhood probing, and global probing. We propose a mathematical model that combines three modes of spreading: local, neighbourhood, and global, to capture the worm’s spreading behaviour. The parameters of the model are inferred directly from network data obtained during the first day of the Conficker epidemic. The model is then used to explore the tradeoff between spreading modes in determining the worm’s effectiveness. Our results show that the Conficker epidemic is an example of a critically hybrid epidemic, in which the different modes of spreading in isolation do not lead to successful epidemics. Such hybrid spreading strategies may be used beneficially to provide the most effective strategies for promulgating information across a large population. When used maliciously, however, they can present a dangerous challenge to current internet security protocols.

Highlights

Epidemic spreading phenomena exist in a wide range of domains [1, 2]
The properties of such epidemics are critically determined by the ratio at which the different spreading mechanisms are mixed, and usually there is an optimal ratio that leads to a maximal outbreak size
In this paper we present a detailed analysis of a real hybrid epidemic—the Internet worm Conficker, which erupted on the Internet in 2008 and infected millions of computers

Summary

Introduction

Epidemic spreading phenomena exist in a wide range of domains [1, 2]. Well-known examples include disease spreading [3,4,5], computer worm proliferation [6,7,8], and information propagation [9,10,11]. We demonstrated that it is possible to have a highly contagious epidemic by mixing simple, ineffective spreading mechanisms The properties of such epidemics are critically determined by the ratio at which the different spreading mechanisms are mixed, and usually there is an optimal ratio that leads to a maximal outbreak size. The worm is a hybrid epidemic as the code analysis [17] has revealed the worm applied three distinct spreading mechanisms: (1) global random spreading, (2) local network spreading, and (3) neighbourhood spreading It is a critically hybrid epidemic because the first and second spreading mechanisms are highly ineffective if used alone, and the third mechanism, as we will show later, is most effective when mixed with the other two. We present the first study on a real-life critically hybrid epidemic, where the epidemic’s parameter values are inferred from measurement data. We analyse the complex interactions among Conficker’s three spreading mechanisms, and show that the worm can be more contagious if it mixes its three spreading mechanisms in an optimal way

Background

Findings

Discussion

Conclusion