TY - GEN
T1 - Top speed of flash worms revisited
AU - Nicol, David M.
PY - 2006
Y1 - 2006
N2 - In a 2004 paper "Top Speed of FlashWorms" Staniford, Moore, Paxson, and Weaver analyze "flash worms", those worms that carry and distribute a target list. Among other things, the authors estimate how fast a flash worm based on Slammer characteristics might spread, showing that 95% of a one million node target list might be infected in approximately half a second. This result depends on identifying and using hosts with high available bandwidth : the host initiating the worm has a 750 Mbps link, and other hosts distributing the worm have broadband scale links. The Staniford et al. paper makes no assumptions about the scheduling of packet deliveries in the hosts that carry out the infection. We propose a scheduling algorithm that uses bandwidth and latency information to construct a schedule designed to accelerate flash worm infection. Using a publicly available latency matrix on 2500 hosts, we find that a scheduled worm spreads five times faster under the original paper's bandwidth assumptions than does an unscheduled one. On a million host problem where latencies only from the root are known we find that the scheduled worm spreads nearly two times faster than an unscheduled one, using the same bandwidth and latency assumptions as the original paper.
AB - In a 2004 paper "Top Speed of FlashWorms" Staniford, Moore, Paxson, and Weaver analyze "flash worms", those worms that carry and distribute a target list. Among other things, the authors estimate how fast a flash worm based on Slammer characteristics might spread, showing that 95% of a one million node target list might be infected in approximately half a second. This result depends on identifying and using hosts with high available bandwidth : the host initiating the worm has a 750 Mbps link, and other hosts distributing the worm have broadband scale links. The Staniford et al. paper makes no assumptions about the scheduling of packet deliveries in the hosts that carry out the infection. We propose a scheduling algorithm that uses bandwidth and latency information to construct a schedule designed to accelerate flash worm infection. Using a publicly available latency matrix on 2500 hosts, we find that a scheduled worm spreads five times faster under the original paper's bandwidth assumptions than does an unscheduled one. On a million host problem where latencies only from the root are known we find that the scheduled worm spreads nearly two times faster than an unscheduled one, using the same bandwidth and latency assumptions as the original paper.
UR - http://www.scopus.com/inward/record.url?scp=84870230735&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84870230735&partnerID=8YFLogxK
M3 - Conference contribution
AN - SCOPUS:84870230735
SN - 8469007262
SN - 9788469007266
T3 - International Mediterranean Modelling Multiconference, I3M
SP - 21
EP - 30
BT - International Mediterranean Modelling Multiconference, IMM
T2 - International Mediterranean Modelling Multiconference, I3M 2006
Y2 - 4 October 2006 through 6 October 2006
ER -