Scan-Based Worms: The Impact of IPV4 Address Space on Epidemic Computer Network Models

The propagation of malicious codes such as worms have been characterized using compartmental epidemic models which are mostly mathematical equations. Aside the challenge of identifying the type of virus or worm represented by these compartmental models, we noticed that the representation of internet protocol (IP) address space is absent. Therefore, this study evaluates the impact of the IPV4 address space using the following epidemic models; SAIR, SEIR, SEI-V, SEIQR and Q-SEIR. By our modifications, the implication is that these models now characterize the scan-based worms that probe the address space in order to find and attack vulnerable computers. To the best of our knowledge, this is the first study that evaluates the impact of this IP addressing format on epidemic computer network models. Numerical simulations with the Runge-Kutta order 4 and 5 method are used to illustrate several existent variations with the models without IPV4 address space. Results are time histories and 3 dimensional phase plots of the models, and from them it was discovered that the standard incidence cancels the effect of adding the expression of IPV4 address scanning space for the worms. More so, characteristically temporal variations were also noted for the susceptible compartment of these models.