4th International IEEE Conference on Broadband Communications, Networks, Systems

Research Article

Modeling and Analysis of Worm Interactions (War of the Worms)

  • @INPROCEEDINGS{10.1109/BROADNETS.2007.4550495,
        author={Sapon Tanachaiwiwa and Ahmed Helmy},
        title={Modeling and Analysis of Worm Interactions (War of the Worms)},
        proceedings={4th International IEEE Conference on Broadband Communications, Networks, Systems},
        publisher={IEEE},
        proceedings_a={BROADNETS},
        year={2010},
        month={5},
        keywords={},
        doi={10.1109/BROADNETS.2007.4550495}
    }
    
  • Sapon Tanachaiwiwa
    Ahmed Helmy
    Year: 2010
    Modeling and Analysis of Worm Interactions (War of the Worms)
    BROADNETS
    IEEE
    DOI: 10.1109/BROADNETS.2007.4550495
Sapon Tanachaiwiwa1, Ahmed Helmy2,*
  • 1: Ming Hsieh Department of Electrical Engineering University of Southern California, CA
  • 2: Computer and Information Science and Engineering University of Florida, FL
*Contact email: helmy@ufl.edu

Abstract

’War of the worms’ is a war between opposing computer worms, creating complex worm interactions as well as detrimental impact on infrastructure. For example, in September 2003 the Welchia worms were launched to terminate the Blaster worms and patch the vulnerable hosts. In this paper, we try to answer the following questions: How can we explain the dynamic of such phenomena with a simple mathematical model? How can one worm win this war? How do other factors such as locality preference, bandwidth, worm replication size and reaction time affect the number of infected hosts? We propose a new Worm Interaction Model (based upon and extending beyond the epidemic model) focusing on random-scan worm interactions. We also propose a new set of metrics to quantify effectiveness of one worm terminating other worm. We validate our worm interaction model using extensive ns-2 simulations. This study provides the first work to characterize and investigate worm interactions of random-scan worms in multi-hop networks.