The analysis of Internet worm modeling in IPv4 and IPv6 networks

Abstract

Worm propagation modeling has been a significant research subject in the Internet-worm research area. An accurate analytical propagation model allows researchers to study the propagation characteristics and traffic pattern of a worm under different set of worm/network parameters, which is often very hard to realize by simulations. More importantly, it gives us an insight into the impact of each worm/network parameter on the propagation of the worm and the effectiveness of a potential defense mechanism that is designed to control the worm propagation. With the occurrence of IPv6, it is a commonly held belief that IPv6 provides greater security against random-scanning worms by virtue of a very sparse address space. It is absolutely necessary to research worm propagation modeling and its propagation properties under IPv4/IPv6 networks. In this paper, we analyze typical worm models in IPv4 network, and use a three-layer worm model named Worm6 to study the worm propagation in IPv6 network. The result shows that worms in IPv6 network by all means use some new scanning strategies in order to form large-scale propagation. By the comparison of Worm6 and IPv4 worm CodeRed, we got the conclusion that the propagation of Worm6 is faster than CodeRed with the same group of parameters. We use simulations to study the Worm6, and demonstrate how the model can be used to study the impact of various worm/network parameters on the propagation.