Date Added: Sep 2011
Research on worm propagation has been conducted for over a decade. However, traditional models overestimate the scale of the infected network that leads to propagation errors because of limited and inaccurate analysis of the propagation procedure between each pair of nodes in the network. This paper studies the propagation mechanism of the two main classes of worms: scanning worms (Code Red II) and non-reinfection email worms. The authors aim at eliminating overestimation in worm propagation modeling caused by errors. Through the analysis of the propagation procedure, they observe that the error is mainly caused by propagation cycles in the propagation path, which are usually ignored by traditional models.