Modeling and Analysis of A Self-Learning Worm Based on Good Point Set Scanning

In order to speed up the propagating process, the worms need to scan many IP addresses to target vulnerable hosts. However, the distribution of IP addresses is highly non-uniform, which results in many scans wasted on invulnerable addresses. Inspired by the theory of good point set, this paper proposes a new scanning strategy, referred to as Good Point Set Scanning (GPSS), for worms. Experimental results show that GPSS can generate more distinct IP addresses and less unused IP addresses than the permutation scanning. Combined with group distribution, a static optimal GPSS is derived.