Top speed of flash worms revisited

In a 2004 paper "Top Speed of FlashWorms" Staniford, Moore, Paxson, and Weaver analyze "flash worms", those worms that carry and distribute a target list. Among other things, the authors estimate how fast a flash worm based on Slammer characteristics might spread, showing that 95% of a one million node target list might be infected in approximately half a second. This result depends on identifying and using hosts with high available bandwidth : the host initiating the worm has a 750 Mbps link, and other hosts distributing the worm have broadband scale links. The Staniford et al. paper makes no assumptions about the scheduling of packet deliveries in the hosts that carry out the infection. We propose a scheduling algorithm that uses bandwidth and latency information to construct a schedule designed to accelerate flash worm infection. Using a publicly available latency matrix on 2500 hosts, we find that a scheduled worm spreads five times faster under the original paper's bandwidth assumptions than does an unscheduled one. On a million host problem where latencies only from the root are known we find that the scheduled worm spreads nearly two times faster than an unscheduled one, using the same bandwidth and latency assumptions as the original paper.