{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,4]],"date-time":"2026-05-04T13:41:32Z","timestamp":1777902092927,"version":"3.51.4"},"reference-count":32,"publisher":"SAGE Publications","issue":"1","license":[{"start":{"date-parts":[[2006,1,1]],"date-time":"2006-01-01T00:00:00Z","timestamp":1136073600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["SIMULATION"],"published-print":{"date-parts":[[2006,1]]},"abstract":"<jats:p>Most well-known worms, such as Code Red, Slammer, Blaster, and Sasser, infected vulnerable computers by scanning the entire IPv4 address space. In this article, the authors present an advanced worm called the \u201crouting worm,\u201d which implements two new attacking techniques. First, a routing worm uses Border Gateway Protocol (BGP) routing tables to only scan the Internet-routable address space, which allows it to propagate three times faster than a traditional worm. Second, and more important, the geographic information of BGP routing prefixes enables a routing worm to conduct pinpoint \u201cselective attacks\u201d by imposing heavy damage to vulnerable computers in a specific country, company, Internet Service Provider, or autonomous system, without collateral damage done to others. Because of the inherent publicity of BGP routing tables, attackers can easily deploy routing worms, which distinguishes the routing worm from other\u201cworst-case\u201d worms. Compared to a traditional worm, a routing worm could possibly cause more severe congestion to the Internet backbone since all scans sent out by it are Internet routable (and can be dropped only at the destination local networks). In addition, it is harder to quickly detect a routing worm-infected computer since we cannot distinguish illegal scans from regular connections sent out from it without waiting for traffic responses. For high-fidelity Internet-scale worm simulations, through this routing worm study, the authors emphasize the importance of simulating failed worm scans and distinguishing nonroutable worm scans from routable scans. In order to defend against routing worms and all scanning worms, an effective way is to upgrade the current Internet from IPv4 to IPv6, although such an upgrade will require a tremendous effort and is still a controversial issue.<\/jats:p>","DOI":"10.1177\/0037549706065344","type":"journal-article","created":{"date-parts":[[2006,5,9]],"date-time":"2006-05-09T06:26:17Z","timestamp":1147155977000},"page":"75-85","source":"Crossref","is-referenced-by-count":8,"title":["Advanced Routing Worm and Its Security Challenges"],"prefix":"10.1177","volume":"82","author":[{"given":"Cliff C.","family":"Zou","sequence":"first","affiliation":[{"name":"School of Electrical Engineering & Computer Science, University of Central Florida, Orlando, FL,"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Don","family":"Towsley","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Massachusetts, Amherst, MA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Weibo","family":"Gong","sequence":"additional","affiliation":[{"name":"Department of Electrical & Computer Engineering, University of Massachusetts, Amherst, MA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Songlin","family":"Cai","sequence":"additional","affiliation":[{"name":"Parallogic Corporation, Sterling, VA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","published-online":{"date-parts":[[2006,1,1]]},"reference":[{"key":"atypb1","first-page":"11","volume-title":"Proceedings of the ACM CCS Workshop on Rapid Malcode (WORM\u201903)","author":"Weaver, N."},{"key":"atypb2","unstructured":"CERT. CERT\/CC advisories. www.cert.org\/advisories\/"},{"key":"atypb3","first-page":"149","volume-title":"Proceedings of USENIX Security Symposium","author":"Staniford, S."},{"key":"atypb4","volume-title":"On the performance of Internet worm scanning strategies","author":"Zou, C. C.","year":"2003"},{"key":"atypb5","volume-title":"Proceedings of the 11th Annual Network and Distributed System Security Symposium (NDSS\u201904)","author":"Wu, J."},{"key":"atypb6","first-page":"138","volume-title":"Proceedings of the 9th ACM Conference on Computer and Communications Security (CCS\u201902)","author":"Zou, C. C."},{"key":"atypb7","first-page":"190","volume-title":"Proceedings of the 10th ACM Conference on Computer and Communications Security (CCS\u201903)","author":"Zou, C. C."},{"key":"atypb8","first-page":"1890","volume-title":"Proceedings of the IEEE INFOCOM","author":"Chen, Z."},{"key":"atypb9","author":"Staniford S.","journal-title":"Journal of Computer Security"},{"key":"atypb10","volume-title":"IMA Workshop 4: Measurement, Modeling and Analysis of the Internet","author":"Nicol, D."},{"key":"atypb11","first-page":"101","volume-title":"Proceedings of 3rd International Workshop on QoS in Multiservice IP Networks (QoS-IP)","author":"Kesidis, G."},{"key":"atypb12","volume-title":"Visualizing Internet topology at a macroscopic scale","author":"CAIDA","year":"2003"},{"key":"atypb13","volume-title":"IPv4 BGP geopolitical analysis","author":"CAIDA","year":"2003"},{"key":"atypb14","unstructured":"Akamai Service: EdgeScape. www.akamai.com\/en\/html\/services\/edgescape.html"},{"key":"atypb15","unstructured":"NetWorld Map project: IP address locator tool. www.geobytes.com\/IpLocator.htm?GetLocation"},{"key":"atypb16","unstructured":"University of Oregon Route Views Project. www.routeviews.org"},{"key":"atypb17","unstructured":"RIPE NCC Routing Information Service. www.ripe.net\/ris"},{"key":"atypb18","volume-title":"BGP-system usage of 32 bit Internet address space","author":"Braun, H. W.","year":"1997"},{"key":"atypb19","volume-title":"IPv4 address space utilization","author":"CAIDA","year":"1998"},{"key":"atypb20","volume-title":"Warhol worms: The potential for very fast Internet plagues","author":"Weaver, N.","year":"2001"},{"key":"atypb21","volume-title":"Security implications of IPv6","author":"Warfield, M. H.","year":"2003"},{"key":"atypb22","unstructured":"IANA. 2004.\n                      Reserved IPv4 addresses\n                      . www.cidr-report.org\/v6\/reserved-ipv4.html"},{"key":"atypb23","volume-title":"CodeRedII worm analysis","author":"eEye Digital Security","year":"2001"},{"key":"atypb24","first-page":"273","volume-title":"Proceedings of the Second ACM SIGCOMM Workshop on Internet Measurement","author":"Moore, D."},{"key":"atypb25","volume-title":"Routing Information Service R.I.S. design note","author":"Antony, A.","year":"1999"},{"key":"atypb26","doi-asserted-by":"publisher","DOI":"10.1109\/MSECP.2003.1219056"},{"key":"atypb27","first-page":"59","volume-title":"Proceedings of the 7th International Symposium on Recent Advances in Intrusion Detection (RAID)","author":"Jung, J."},{"key":"atypb28","first-page":"29","volume-title":"Proceedings of 13th USENIX Security Symposium","author":"Weaver, N."},{"key":"atypb29","author":"Zou, C. C.","journal-title":"Journal of Performance Evaluation"},{"key":"atypb30","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2004.59"},{"key":"atypb31","volume-title":"RFC-3513: Internet Protocol Version 6 (IPv6) addressing architecture","author":"Hinden, R.","year":"2003"},{"key":"atypb32","volume-title":"RFC- 3587: IPv6 global unicast address format","author":"Hinden, R.","year":"2003"}],"container-title":["SIMULATION"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/0037549706065344","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/0037549706065344","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T11:19:32Z","timestamp":1777634372000},"score":1,"resource":{"primary":{"URL":"https:\/\/journals.sagepub.com\/doi\/10.1177\/0037549706065344"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2006,1]]},"references-count":32,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2006,1]]}},"alternative-id":["10.1177\/0037549706065344"],"URL":"https:\/\/doi.org\/10.1177\/0037549706065344","relation":{},"ISSN":["0037-5497","1741-3133"],"issn-type":[{"value":"0037-5497","type":"print"},{"value":"1741-3133","type":"electronic"}],"subject":[],"published":{"date-parts":[[2006,1]]}}}