Efficient simulation of Internet worms

Simulation of Internet worms (and other malware) requires tremendous computing resources when every packet generated by the phenomena is modeled individually; on the other hand, models of worm growth based on differential equations lack the significant variability inherent in worms that sample targe...

Full description

Saved in:
Bibliographic Details
Published in:ACM transactions on modeling and computer simulation 2008-04, Vol.18 (2), p.1-32
Main Author: Nicol, David M.
Format: Article
Language:English
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Simulation of Internet worms (and other malware) requires tremendous computing resources when every packet generated by the phenomena is modeled individually; on the other hand, models of worm growth based on differential equations lack the significant variability inherent in worms that sample targets randomly. This article addresses the problem with a model that focuses on times of infection. We propose a hybrid discrete-continuous model that minimizes execution time subject to an accuracy constraint on variance. We also develop an efficiently executed model of preferential random scanning and use it to investigate the sensitivity of worm propagation speed to the distribution of susceptible hosts through the network, and to the local preference probability. Finally, we propose and study two optimizations to a fluid-based simulation of scan traffic through a backbone network, observing an order-of-magnitude improvement in execution speed.
ISSN:1049-3301
1558-1195
DOI:10.1145/1346325.1346326