Top speed of flash worms revisited

Research output: Chapter in Book/Report/Conference proceedingConference contribution


In a 2004 paper "Top Speed of FlashWorms" Staniford, Moore, Paxson, and Weaver analyze "flash worms", those worms that carry and distribute a target list. Among other things, the authors estimate how fast a flash worm based on Slammer characteristics might spread, showing that 95% of a one million node target list might be infected in approximately half a second. This result depends on identifying and using hosts with high available bandwidth : the host initiating the worm has a 750 Mbps link, and other hosts distributing the worm have broadband scale links. The Staniford et al. paper makes no assumptions about the scheduling of packet deliveries in the hosts that carry out the infection. We propose a scheduling algorithm that uses bandwidth and latency information to construct a schedule designed to accelerate flash worm infection. Using a publicly available latency matrix on 2500 hosts, we find that a scheduled worm spreads five times faster under the original paper's bandwidth assumptions than does an unscheduled one. On a million host problem where latencies only from the root are known we find that the scheduled worm spreads nearly two times faster than an unscheduled one, using the same bandwidth and latency assumptions as the original paper.

Original languageEnglish (US)
Title of host publicationInternational Mediterranean Modelling Multiconference, IMM
Number of pages10
StatePublished - 2006
EventInternational Mediterranean Modelling Multiconference, I3M 2006 - Barcelona, Spain
Duration: Oct 4 2006Oct 6 2006

Publication series

NameInternational Mediterranean Modelling Multiconference, I3M


OtherInternational Mediterranean Modelling Multiconference, I3M 2006

ASJC Scopus subject areas

  • Modeling and Simulation


Dive into the research topics of 'Top speed of flash worms revisited'. Together they form a unique fingerprint.

Cite this