I’ve got worms!

Posted by Steve Hanna on September 23rd, 2005 filed in Technical Tags: electromagnetics, flashworm, research, school

…flashworms that is! I have been doing some thesis research on worms that spread really, really fast. Lately I have been conducting a literature search using this paper as the main focal point. Basically, a literature search involves scouring the internet to make sure that someone hasn’t done similar work. Thus far, after using the wonderful resource that is the library. I have only found two papers that reference this work and they are in regards to mitigating flash worms spread (this information was found from the glorious librarians). As one can see, this is fairly excellent news.

So, I have rambled on and on about the paper I am using as a basis for my work but I have yet to say exactly what I am doing. The project that I am embarking upon is largely based upon their work. Yet, instead of modeling the infection of one million hosts using a mathematical model, I am actually going to write a very small UDP worm and simulate the infection of one million hosts in a closed network. Yes, this project is as cool as it sounds… if only my electromagnetics class would let up a bit so I can crank out some quality code…

So I read some cool stuff in the paper How To 0wn the Internet in Your Spare Time. Specifically, they model some differential equations for population growth (basic logistic function). They come up with these results:
where:
a - proportion of population that is infected
T - Fixed event in time when initial infection occured
t - Time that has passed
K - Rate of infection (computer to computer)
N - total number of vulnerable servers

Nda = (Na)K(1-a)dt
da/dt = Ka(1-a)
thus,
a = (e^(K(t-T)))/(1 + e^(K(t-T))) < —god that looks ugly

So this tells us that the ratio of infection is only dependent on the rate of infection, which is kind of a cool conclusion. It tells us that the results are independent of the number of machines infected (although one can reasonably conclude that K is somewhat dependent on the other infections…backscatter, clogged internet backbones, etc).

So, that’s all for now. I figured since I hadn’t posted recently, I should at least let the intarweb know what’s been keeping me busy.

Also, I plan to post my ECE329 notes from my tablet fairly soon…hopefully they can help some people out with the class.

Eeep.