Modeling and analysis of Internet worm propagation

Although the frequency of Internet worm's outbreak is decreased during the past ten years, the impact of worm on people's privacy security and enterprise's efficiency is still a severe problem, especially the emergence of botnet. It is urgent to do more research about worm's propagation model and security defense. The well-known worm models, such as simple epidemic model (SEM) and two-factor model (TFM), take all the computers on the internet as the same, which is not accurate because of the existence of network address translation (NAT). In this paper, we first analyze the worm's functional structure, and then we propose a three layer worm model named three layres worm model (TLWM), which is an extension of SEM and TFM under NAT environment. We model the TLWM by using deterministic method as it is used in the TFM. The simulation results show that the number of NAT used on the Internet has effects on worm propagation, and the more the NAT used, the slower the worm spreads. So, the extensive use of NAT on the Internet can restrain the worm spread to some extent. © 2010 The Journal of China Universities of Posts and Telecommunications.