{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T04:35:40Z","timestamp":1750307740532,"version":"3.41.0"},"reference-count":14,"publisher":"Association for Computing Machinery (ACM)","issue":"2","license":[{"start":{"date-parts":[[2008,4,1]],"date-time":"2008-04-01T00:00:00Z","timestamp":1207008000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["335241"],"award-info":[{"award-number":["335241"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Model. Comput. Simul."],"published-print":{"date-parts":[[2008,4]]},"abstract":"<jats:p>We present a simple, deterministic mathematical model for the spread of randomly scanning and bandwidth-saturating Internet worms. Such worms include Slammer and Witty, both of which spread extremely rapidly. Our model, consisting of coupled Kermack-McKendrick (a.k.a. stratified susceptibles-infectives (SI)) equations, captures both the measured scanning activity of the worm and the network limitation of its spread, that is, the effective scan-rate per worm\/infective. The Internet is modeled as an ideal core network to which each peripheral (e.g., enterprise) network is connected via a single access link. It is further assumed in this note that as soon as a single end-system in the peripheral network is infected by the worm, the subsequent scanning of the rest of the Internet saturates the access link, that is, there is \u201cinstant\u201d saturation. We fit our model to available data for the Slammer worm and demonstrate the model's ability to accurately represent Slammer's total scan-rate to the core.<\/jats:p>","DOI":"10.1145\/1346325.1346327","type":"journal-article","created":{"date-parts":[[2008,4,29]],"date-time":"2008-04-29T13:01:12Z","timestamp":1209474072000},"page":"1-14","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":13,"title":["A model of the spread of randomly scanning Internet worms that saturate access links"],"prefix":"10.1145","volume":"18","author":[{"given":"George","family":"Kesidis","sequence":"first","affiliation":[{"name":"Pennsylvania State University, University Park, PA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ihab","family":"Hamadeh","sequence":"additional","affiliation":[{"name":"Pennsylvania State University, University Park, PA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Youngmi","family":"Jin","sequence":"additional","affiliation":[{"name":"Pennsylvania State University, University Park, PA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Soranun","family":"Jiwasurat","sequence":"additional","affiliation":[{"name":"Pennsylvania State University, University Park, PA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Milan","family":"Vojnovi\u0107","sequence":"additional","affiliation":[{"name":"Microsoft Research, Cambridge, U.K"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2008,4,28]]},"reference":[{"volume-title":"Proceedings of IEEE INFOCOM","author":"Chen Z.","key":"e_1_2_1_1_1","unstructured":"Chen , Z. , Gao , L. , and Kwait , K . 2003. Modeling the spread of active worms . In Proceedings of IEEE INFOCOM ( San Fransisco, CA). Chen, Z., Gao, L., and Kwait, K. 2003. Modeling the spread of active worms. In Proceedings of IEEE INFOCOM (San Fransisco, CA)."},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/1029618.1029627"},{"key":"e_1_2_1_3_1","unstructured":"Daley D. and Gani J. 1999. Epidemic Modeling an Introduction. Cambridge University Press Cambridge U.K.  Daley D. and Gani J. 1999. Epidemic Modeling an Introduction. Cambridge University Press Cambridge U.K."},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-30573-6_8"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611970333"},{"volume-title":"Proceedings of IEEE\/Create-Net TridentCom.","author":"Li L.","key":"e_1_2_1_6_1","unstructured":"Li , L. , Jiwasurat , S. , Hamadeh , I. , Kesidis , G. , Neumann , C. , and Liu , P . 2006. Emulating sequential scanning worms on the DETER testbed . In Proceedings of IEEE\/Create-Net TridentCom. ( Barcelona, Spain). Li, L., Jiwasurat, S., Hamadeh, I., Kesidis, G., Neumann, C., and Liu, P. 2006. Emulating sequential scanning worms on the DETER testbed. In Proceedings of IEEE\/Create-Net TridentCom. (Barcelona, Spain)."},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/948187.948193"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSECP.2003.1219056"},{"volume-title":"Proceedings of IEEE INFOCOM.","author":"Moore D.","key":"e_1_2_1_9_1","unstructured":"Moore , D. , Shannon , C. , Voelker , G. M. , and Savage , S . 2003b. Internet quarantine: Requirements for containing self-propagating code . In Proceedings of IEEE INFOCOM. ( San Francisco, CA). Moore, D., Shannon, C., Voelker, G. M., and Savage, S. 2003b. Internet quarantine: Requirements for containing self-propagating code. In Proceedings of IEEE INFOCOM. (San Francisco, CA)."},{"volume-title":"Proceedings of USENIX Security Symposium. 149--167","author":"Staniford S.","key":"e_1_2_1_10_1","unstructured":"Staniford , S. , Paxson , V. , and Weaver , N . 2002. How to own the Internet in your spare time . In Proceedings of USENIX Security Symposium. 149--167 . Staniford, S., Paxson, V., and Weaver, N. 2002. How to own the Internet in your spare time. In Proceedings of USENIX Security Symposium. 149--167."},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/1029618.1029628"},{"volume-title":"Proceedings of the 13th USENIX Security Symposium.","author":"Weaver N.","key":"e_1_2_1_12_1","unstructured":"Weaver , N. , Staniford , S. , and Paxson , V . 2004b. Very fast containment of scanning worms . In Proceedings of the 13th USENIX Security Symposium. Weaver, N., Staniford, S., and Paxson, V. 2004b. Very fast containment of scanning worms. In Proceedings of the 13th USENIX Security Symposium."},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/586110.586130"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/948187.948197"}],"container-title":["ACM Transactions on Modeling and Computer Simulation"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1346325.1346327","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1346325.1346327","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T13:38:57Z","timestamp":1750253937000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1346325.1346327"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2008,4]]},"references-count":14,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2008,4]]}},"alternative-id":["10.1145\/1346325.1346327"],"URL":"https:\/\/doi.org\/10.1145\/1346325.1346327","relation":{},"ISSN":["1049-3301","1558-1195"],"issn-type":[{"type":"print","value":"1049-3301"},{"type":"electronic","value":"1558-1195"}],"subject":[],"published":{"date-parts":[[2008,4]]},"assertion":[{"value":"2004-12-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2006-04-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2008-04-28","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}