\documentclass{sig-alternate}
\newcommand{\be}{\begin{equation}}
\newcommand{\ee}{\end{equation}}
%\usepackage{color}\pagecolor{white}
% these settings give 2.5 cm margin on all sides, per NSF directives
%\textwidth 6.5in \oddsidemargin 0in \evensidemargin 0in \topmargin
%1.0cm \textheight 23.cm \headheight 0.in
\begin{document}

% --- Author Metadata here ---
\conferenceinfo{CCS'02,} {November 18-22, 2002, Washington, DC, USA.} \CopyrightYear{2002}
\crdata{1-58113-612-9/02/0011}
% --- End of Author Metadata ---

\title{Code Red Worm Propagation Modeling and Analysis \titlenote{This work was supported in part by ARO contract
DAAD19-01-1-0610; by contract 2000-DT-CX-K001 from the U.S. Department of Justice, Office of Justice
Programs; by DARPA under contract F30602-00-2-0554 and by NSF under Grant EIA-0080119.}}

\numberofauthors{3}

\author{
\alignauthor Cliff Changchun Zou \\
       \affaddr{Dept. Electrical \&}\\
       \affaddr{Computer Engineering}\\
       \affaddr{Univ. Massachusetts}\\
       \affaddr{Amherst, MA}\\
       \email{czou@ecs.umass.edu}
\alignauthor Weibo Gong\\
       \affaddr{Dept. Electrical \&} \\
       \affaddr{Computer Engineering}\\
       \affaddr{Univ. Massachusetts}\\
       \affaddr{Amherst, MA}\\
       \email{gong@ecs.umass.edu}
\alignauthor Don Towsley\\
       \affaddr{Dept. Computer Science}\\
       \affaddr{Univ. Massachusetts}\\
       \affaddr{Amherst, MA}\\
       \email{towsley@cs.umass.edu}
}
\date{}
\maketitle
\begin{abstract}
The Code Red worm incident of July 2001 has stimulated activities to model and analyze Internet worm
propagation. In this paper we provide a careful analysis of Code Red propagation by accounting for two
factors: one is the dynamic countermeasures taken by ISPs and users; the other is the slowed down worm
infection rate because Code Red rampant propagation caused congestion and troubles to some routers. Based on
the classical epidemic Kermack-Mckendrick model, we derive a general Internet worm model called the
\textit{two-factor worm model}. Simulations and numerical solutions of the two-factor worm model match the
observed data of Code Red worm better than previous models do. This model leads to a better understanding and
prediction of the scale and speed of Internet worm spreading.
\end{abstract}

% A category with the (minimum) three required fields
\category{H.1}{Models and Principles}{Miscellaneous}
%A category including the fourth, optional field follows...
%\category{D.2.8}{Software Engineering}{Metrics}[complexity measures, performance measures]

\terms{Security, Human Factors}

\keywords{Internet worm modeling, epidemic model, two-factor worm model}

\section{Introduction}

The easy access and wide usage of the Internet makes it a primary target for malicious activities. In
particular, the Internet has become a powerful mechanism for propagating malicious software programs. Worms,
defined as autonomous programs that spread through computer networks by searching, attacking, and infecting
remote computers automatically, have been developed for more than 10 years since the first Morris worm
\cite{MorrisWorm}. Today, our computing infrastructure is more vulnerable than ever before
\cite{SymantecThreat}. The Code Red worm and Nimda worm incidents of 2001 have shown us how vulnerable our
networks are and how fast a virulent worm can spread; furthermore, Weaver presented some design principles
for worms such that they could spread even faster \cite{WeaverWeb}. In order to defend against future worms,
we need to understand various properties of worms: the propagation pattern during the lifetime of worms; the
impact of patching, awareness and other human countermeasures; the impact of network traffic, network
topology, etc.

An accurate Internet worm model provides insight into worm behavior. It aids in identifying the weakness in
the worm spreading chain and provides accurate prediction for the purpose of damage assessment for a new worm
threat. In epidemiology research, there exist several deterministic and stochastic models for virus spreading
\cite{Anderson91, Andersson00, Bailey75, Frauenthal80}; however, few models exist for Internet worm
propagation modeling. Kephart, White and Chess of IBM performed a series of studies from 1991 to 1993 on
viral infection based on epidemiology models \cite{IBM1, IBM2, IBMmodel}. Traditional epidemic models are all
\textit{homogeneous}, in the sense that an infected host is equally likely to infect any of other susceptible
hosts \cite{Bailey75, Frauenthal80}. Considering the local interactions of viruses at that time, \cite{IBM1,
IBM2} extended those epidemic models onto some non-homogeneous networks: random graph, two-dimensional
lattice and tree-like hierarchical graph. Though at that time the local interaction assumption was accurate
because of sharing disks, today it's no longer valid for worm modeling when most worms propagate through the
Internet and are able to directly hit a target. In addition, the authors used susceptible - infected -
susceptible (SIS) model for viruses modeling, which assumes that a cured computer can be reinfected
immediately. However, SIS model is not suitable for modeling a single worm propagation since once an infected
computer is patched or cleaned, it's more likely to be immune to this worm. Wang \textit{et al.} presented
simulation results of a simple virus propagation on clustered and tree-like hierarchical networks
\cite{Wang00}. They showed that in certain topologies selective immunization can significantly slow down
virus propagation \cite{Wang00}. However, their conclusion was based on a tree-like hierarchic topology,
which is not suitable for the Internet.

The Code Red worm incident of July 2001 has stimulated activities to model and analyze Internet worm
propagation. Staniford \textit{et al.} used the classical simple epidemic equation to model Code Red spread
right after the July 19th incident \cite{StanifordWeb}. Their model matched pretty well with the limited
observed data. Heberlein presented a visual simulation of Code Red worm propagation on Incident.com
\cite{HeberleinWeb}. Moore provided some valuable observed data and a detailed analysis of Code Red worm
behavior \cite{CaidaWeb}. Weaver provided some worm design principles, which can be used to produce worms
that spread even faster than the Code Red and Nimda worms \cite{WeaverWeb}.

Previous work on worm modeling neglects the dynamic effect of human countermeasures on worm behavior. Wang
\textit{et al.} \cite{Wang00} investigated the immunization defense. But they considered only static
immunization, which means that a fraction of the hosts are immunized before the worm propagates. In reality,
human countermeasures are dynamic actions and play a major role in slowing down worm propagation and
preventing worm outbreaks. Many new viruses and worms come out every day. Most of them, however, die away
without infecting many computers due to human countermeasures.

Human countermeasures against a virus or worm include:
\begin{itemize}
\item Using anti-virus softwares or special programs to clean infected computers.
\item Patching or upgrading susceptible computers to make them immune to the virus or worm.
\item Setting up filters on firewalls or routers to filter or block the virus or worm traffic.
\item Disconnecting networks or computers when no effective methods are available.
\end{itemize}

In the epidemic modeling area, the virus infection rate is assumed to be constant. Previous Internet virus
and worm models (except \cite{WeaverWeb}) treat the time required for an infected host to find a target,
whether it is already infected or still susceptible, as constant as well. In \cite{WeaverWeb}, the author
treated the infection rate as a random variable by considering the unsuccessful IP scan attempts of a worm.
The mean value of the infection rate, however, is still assumed to be constant over time. A constant
infection rate is reasonable for modeling epidemics but may not be valid for Internet viruses and worms.

In this paper, through analysis of the Code Red incident of July 19th 2001, we find that there were two
factors affecting Code Red propagation: one is the dynamic countermeasures taken by ISPs and users; the other
is the slowed down worm infection rate because the rampant propagation of Code Red caused congestion and
troubles to some routers. By accounting for both the dynamic aspects of human countermeasures and the
variable infection rate, we derive a more accurate worm propagation model: the \textit{two-factor} worm
model. Simulation results and numerical solutions show that our model matches well with the observed Code Red
data. In particular, it explains the decrease in Code Red scan attempts observed during the last several
hours of July 19th \cite{KenData, DaveData} before Code Red ceased propagation --- none of previous worm
models are able to explain such phenomenon. It also shows that Code Red didn't infect almost all susceptible
online computers at 19:00 UTC as concluded in \cite{StanifordWeb}. Instead, Code Red infected roughly 60\% of
all susceptible online computers at that time.

The rest of the paper is organized as follows. Section 2 gives a brief description of the Code Red worm
incident of July 2001. In Section 3, we give a brief review of two classical epidemic models and point out
several problems that they exhibit when modeling Internet worms. In Section 4, we describe the two factors
that are unique to the Internet worm propagation and present a new Internet worm model: the
\textit{two-factor} worm model. We present Code Red simulations based on the new model in Section 5. We
derive a set of differential equations describing the behavior of the two-factor worm model in Section 6 and
provide corresponding numerical solutions. Both the simulation results and the numerical solutions match well
with the observed Code Red data. Section 7 concludes the paper with some discussions.

\section{Background on Code Red worm}

On June 18th 2001 a serious Windows IIS vulnerability was discovered \cite{Cnetnews1}. After almost one
month, the first version of Code Red worm that exploited this vulnerability emerged on July 13th, 2001
\cite{eeyeWeb}. Due to a code error in its random number generator, it did not propagate well
\cite{cnetNews2}. The truly virulent strain of the worm (Code Red version 2) began to spread around 10:00 UTC
of July 19th \cite{CaidaWeb}. This new worm had implemented the correct random number generator. It generated
100 threads. Each of the first 99 threads randomly chose one IP address and tried to set up connection on
port 80 with the target machine \cite{eeyeWeb} (If the system was an English Windows 2000 system, the 100th
worm thread would deface the infected system's web site, otherwise the thread was used to infect other
systems, too). If the connection was successful, the worm would send a copy of itself to the victim web
server to compromise it and continue to find another web server. If the victim was not a web server or the
connection could not be setup, the worm thread would randomly generate another IP address to probe. The
timeout of the Code Red connection request was programmed to be 21 seconds \cite{SilentBladeWeb}. Code Red
can exploit only Windows 2000 with IIS server installed --- it can't infect Windows NT because the jump
address in the code is invalid under NT \cite{eeyeWeb2}.

Code Red worm (version 2) was programmed to uniformly scan the IP address space. Netcraft web server survey
showed that there were about 6 million Windows IIS web servers at the end of June 2001\cite{Netcraft}. If we
conservatively assume that there were less than 2 million IIS servers online on July 19th, on average each
worm would need to perform more than 2000 IP scans before it could find a Windows IIS server. The worm would
need, on average, more than 4000 IP scans to find a target if the number of Windows IIS servers online was
less than 1 million. Code Red worm continued to spread on July 19th until 0:00 UTC July 20th, after which the
worm stopped propagation by design \cite{CertCodeRedWeb}.

Three independent observed data sets are available on the Code Red incident of July 19th. Goldsmith and
Eichman collected two types of data on two class B networks independently \cite{KenData, DaveData}: one is
the number of Code Red worm port 80 scans during each hour, the other is the number of unique sources that
generated these scans during each hour. The number of Code Red scan attempts from these two data sets are
plotted in Fig. \ref{fig:DataSet2}(a) and the number of unique sources in Fig. \ref{fig:DataSet2}(b) as
functions of time.

\begin{figure*}[t]
\centering{\begin{minipage}{.35\linewidth} \centering\epsfig{file=scandata2.eps,width=\linewidth}
\centering{\text{a. Code Red scan attempts}}
\end{minipage} \hspace{50pt}
\begin{minipage}{.35\linewidth}
\centering\epsfig{file=sourcedata2.eps,width=\linewidth} \centering{\text{b. Code Red scan unique sources}}
\end{minipage}}
\caption{Code Red scan data on two Class B networks } \label{fig:DataSet2}
\end{figure*}

Since Code Red worm was programmed to choose random IP addresses to scan, each IP address is equally likely
to be scanned by a Code Red worm. It explains why the Code Red probes on these two Class B networks were so
similar to each other as shown in Fig. \ref{fig:DataSet2}.

Each of the two class B networks covers only 1/65536th of the whole IP address space; therefore, the number
of unique sources and the number of scans in Fig. \ref{fig:DataSet2} are only a portion of active Code Red
worms on the whole Internet at that time. However, they correctly exhibit the pattern of Code Red propagation
because of the uniform scan of Code Red --- this is the reason why we can use the data to study Code Red
propagation.

Because each infected computer would generate 99 simultaneous scans (one scan per thread) \cite{eeyeWeb}, the
number of worm scans was bigger than the number of unique sources. However, Fig. \ref{fig:DataSet2} shows
that the number of unique sources and the number of scans have the identical evolvement over time --- both of
them are able to represent Code Red propagation on the Internet. For example, if the number of active Code
Red infected computers on the Internet increased 10 times in one hour, both the number of unique sources and
the number of scans observed by Goldsmith and Eichman would increase about 10 times.

Moore \textit{et al.} provided another valuable data set collected on Code Red worm during the whole day of
July 19th \cite{CaidaWeb}. Not like the data collected by Goldsmith and Eichman, which were recounted at each
hour, Moore \textit{et al.} recorded the time of the first attempt of each infected host to spread the worm
to their networks. Thus the number of infected hosts in their data is a non-decreasing function of time. The
number of infected hosts observed is shown in Fig. \ref{fig:caida1} as a function of time $t$.

\begin{figure}[h]
\centering\epsfig{file=caida.eps,width=.80\linewidth} \caption{Observed Code Red propagation --- number of
infected hosts (from Caida.org)} \label{fig:caida1}
\end{figure}

When rebooted, a Code Red infected computer went back to susceptible state and could be reinfected again
\cite{CertCodeRedWeb}. However, this would not affect the number of infected hosts shown in Fig.
\ref{fig:caida1} --- a reinfected host would use the same source IP to scan, thus it would not be recounted
into the data collected by Moore \textit{et al.}.

Moore \textit{et al.} considered patching and filtering too when they collected Code Red data
\cite{CaidaWeb}. The authors observed that during the course of the day, many initially infected machines
were patched, rebooted, or filtered and consequently ceased to probe the Internet. A host that was previously
infected was considered by the authors to be deactivated after no further unsolicited traffic was observed
from it. The number of observed deactivated hosts over time is shown in Fig. \ref{fig:caida2}.

\begin{figure}[h]
\centering\epsfig{file=caida-deactivated.eps,width=.80\linewidth} \caption{Observed Code Red propagation ---
number of deactivated hosts (from Caida.org)}\label{fig:caida2}
\end{figure}

Since Code Red worm was programmed to stop spreading after 00:00 UTC  July 20th, the number of infected hosts
stopped increasing after 00:00 UTC. Otherwise the curve in Fig. \ref{fig:caida1} would have kept increasing
to some extent. The abrupt rise in host inactivity in Fig. \ref{fig:caida2} at 00:00 UTC is also due to the
worm design of stopping infection at the midnight.

\bigskip

We are interested in the following issues: How can we explain these Code Red worm propagation curves shown in
Fig. \ref{fig:DataSet2}, \ref{fig:caida1}, and Fig. \ref{fig:caida2}? What factors affect the spreading
behavior of an Internet worm? Can we derive a more accurate model for an Internet worm?

\section{Using epidemic models to model Code Red worm propagation}

Computer viruses and worms are similar to biological viruses on their self-replicating and propagation
behaviors. Thus the mathematical techniques which have been developed for the study of biological infectious
diseases might be adapted to the study of computer viruses and worms propagation.

In epidemiology area, both stochastic models and deterministic models exist for modeling the spreading of
infectious diseases \cite{Anderson91, Andersson00, Bailey75, Frauenthal80}. Stochastic models are suitable
for small-scale system with simple virus dynamics; deterministic models are suitable for large-scale system
under the assumption of mass action, relying on the law of large number \cite{Andersson00}. When we model
Internet worms propagation, we consider a large-scale network with thousands to millions of computers. Thus
we will only consider and use deterministic models in this paper. In this section, we introduce two classical
deterministic epidemic models, which are the bases of our two-factor Internet worm model. We also point out
their problems when we try to use them to model Internet worm propagation.

In epidemiology modeling, hosts that are vulnerable to be infected by virus are called \textit{susceptible}
hosts; hosts that have been infected and can infect others are called \textit{infectious} hosts; hosts that
are immune or dead such that they can't be infected by virus are called \textit{removed} hosts, no matter
whether they have been infected before or not. A host is called an \textit{infected} host at time $t$ if it
has been infected by virus before $t$, no matter whether it is still infectious or is removed
\cite{Andersson00} at time $t$. In this paper, we will use the same terminology for computer worms modeling.

\subsection{Classical simple epidemic model}

In classical simple epidemic model, each host stays in one of two states: susceptible or infectious. The
model assumes that once a host is infected by a virus, it will stay in infectious state forever. Thus state
transition of any host can only be: susceptible $\rightarrow$ infectious \cite{Frauenthal80}. The classical
simple epidemic model for a finite population is

\begin{equation}
\frac{dJ(t)}{dt} =\beta J(t)[N-J(t)], \label{eq:model1}
\end{equation}
where $J(t)$  is the number of infected hosts at time $t$; $N$ is the size of population; and $\beta$ is the
infection rate.  At beginning, $t=0$, $J(0)$ hosts are infectious and the other $N-J(0)$ hosts are all
susceptible.

Let $a(t)= J(t)/N$ be the fraction of the population that is infectious at time $t$ . Dividing both sides of
(\ref{eq:model1}) by $N^2$ yields the equation used in \cite{StanifordWeb}:
\begin{equation}
\frac{da(t)}{dt} =ka(t)[1-a(t)], \label{eq:model_staniford}
\end{equation}
where $k=\beta N$. Using the same value $k=1.8$ as what used in \cite{StanifordWeb}, the dynamic curve of
$a(t)$ is plotted in Fig. \ref{fig:model2}.
\begin{figure}[h]
\centering\epsfig{file=model2.eps,width=.70\linewidth} \caption{Classical simple epidemic model ($k = 1.8$)}
\label{fig:model2}
\end{figure}

Let $S(t)=N-J(t)$ denote the number of susceptible hosts at time $t$. Replace $J(t)$ in (\ref{eq:model1}) by
$N-S(t)$ and we get
\begin{equation}
\frac{dS(t)}{dt} =-\beta S(t)[N-S(t)]. \label{eq:model2}
\end{equation}

Equation (\ref{eq:model1}) is identical with (\ref{eq:model2}) except for a minus sign. Thus the curve in
Fig. \ref{fig:model2} will remain the same when we rotate it 180 degrees around the $(t_{half}, 0.5)$ point
where $J(t_{half})=S(t_{half})=N/2$. Fig. \ref{fig:model2} and Eq. (\ref{eq:model_staniford}) show that at
the beginning when $1-a(t)$ is roughly equal to $1$, the number of infectious hosts is nearly exponentially
increased. The propagation rate begins to decrease when about 80\% of all susceptible hosts have been
infected.

Staniford \textit{et al.} \cite{StanifordWeb} presented a Code Red propagation model based on the data
provided by Eichman \cite{IncidentsWeb} up to 21:00 UTC July 19th. The model captures the key behavior of the
first half part of the Code Red dynamics. It is essentially the classical simple epidemic model
(\ref{eq:model1}). We provide, in this paper, a more detailed analysis that accounts for two important
factors involved in Code red spreading.  Part of our effort is to explain the evolution of Code Red spreading
after the beginning phase of its propagation. Although the classical epidemic model can match the beginning
phase of Code Red spreading, it can't explain the later part of Code Red propagation: during the last five
hours from 20:00 to 00:00 UTC, the worm scans kept decreasing (Fig. \ref{fig:DataSet2}).

From the simple epidemic model (Fig. \ref{fig:model2}), the authors in \cite{StanifordWeb} concluded that
Code Red came to saturating around 19:00 UTC --- almost all susceptible IIS servers online on July 19th had
been infected around that time. The numerical solution of our model in Section 6, however, shows that only
about 60\% of all susceptible IIS servers online have been infected around 19:00 UTC on July 19th.

\subsection{Classical general epidemic model: Kermack-Mckendrick model }

In epidemiology area, Kermack-Mckendrick model considers the removal process of infectious hosts
\cite{Frauenthal80}. It assumes that during an epidemic of a contagious disease, some infectious hosts either
recover or die; once a host recovers from the disease, it will be immune to the disease forever --- the hosts
are in ``removed" state after they recover or die from the disease. Thus each host stays in one of three
states at any time: susceptible, infectious, removed. Any host in the system has either the state transition
``susceptible $\rightarrow$ infectious $\rightarrow$ removed" or stays in ``susceptible" state forever.

Let $I(t)$ denote the number of infectious hosts at time $t$. We use $R(t)$ to denote the number of removed
hosts from previously infectious hosts at time $t$. A \textit{removed} host from the infected population at
time $t$ is a host that is once infected but has been disinfected or removed from circulation before time
$t$. Let $J(t)$ denote the number of infected hosts by time $t$, no matter whether they are still in
infectious state or have been removed. Then
\begin{equation}
J(t)=I(t)+R(t).  \label{eq:JIR}
\end{equation}

Based on the simple epidemic model (\ref{eq:model1}), Kermack-Mckendrick model is
\begin{equation}
\left\{
\begin{array}{ll}
dJ(t)/dt &=\beta J(t)[N-J(t)] \\
dR(t)/dt &=\gamma I(t)        \\
J(t)             &=I(t)+R(t)=N - S(t) \\
\end{array}
\right.  \label{eq:KMmodel}
\end{equation}
where $\beta$ is the infection rate; $\gamma$ is the rate of removal of infectious hosts from circulation;
$S(t)$ is the number of susceptible hosts at time $t$; $N$ is the size of population.

Define $\rho\equiv \gamma/\beta$ to be the \textit{relative removal rate} \cite{Bailey75}. One interesting
result coming out of this model is
\begin{equation}
 \frac{dI(t)}{dt}>0 \text{  if and only if  } S(t)>\rho.
\end{equation}

Since there is no new susceptible host to be generated, the number of susceptible hosts $S(t)$ is a
monotonically decreasing function of time $t$. If $S(t_0)< \rho$, then $S(t) < \rho$ and $dI(t)/dt<0$ for all
future time $t>t_0$. In other words, if the initial number of susceptible hosts is smaller than some critical
value, $S(0)<\rho$, there will be no epidemic and outbreak \cite{Frauenthal80}.

The Kermack-Mckendrick model improves the classical simple epidemic model by considering that some infectious
hosts either recover or die after some time. However, this model is still not suitable for modeling Internet
worm propagation. First, in the Internet, cleaning, patching, and filtering countermeasures against worms
will remove both susceptible hosts and infectious hosts from circulation, but Kermack-Mckendrick model only
accounts for the removal of infectious hosts. Second, this model assumes the infection rate to be constant,
which isn't true for a rampantly spreading Internet worm such as the Code Red worm.

We list in Table. \ref{tb:table1} some frequently used notations in this paper. The ``removed" hosts are out
of the circulation of a worm --- they can't be infected anymore and they don't try to infect others.

\begin{table*}[t]
 \caption{Notations in this paper}\label{tb:table1}
 \centering{\begin{tabular}{|l|l|}
  \hline
    Notation        & Explanation  \\ \hline
    $S(t)$          &  Number of susceptible hosts at time $t$\\
    $I(t)$          &  Number of infectious hosts at time $t$ \\
    $R(t)$          &  Number of removed hosts from the infectious population at time $t$\\
    $Q(t)$          &  Number of removed hosts from the susceptible population at time $t$\\
    $N$             &  Total number of hosts under consideration, $N=I(t)+R(t)+Q(t)+S(t)$  \\
    $J(t)$          &  Number of infected hosts at time $t$, i.e., $J(t)=I(t)+R(t)$\\
    $C(t)$          &  Total number of removed hosts at time $t$, i.e., $C(t)=R(t)+Q(t)$\\
    $\beta(t)$      &  Infection rate at time $t$\\
    $D(t)$          &  Infection delay time in simulation, representing the time for a Code Red worm to find an IIS server\\\hline

  \end{tabular}}
\end{table*}

\section{A new Internet worm model: two-factor worm model}

The propagation of a real worm on the Internet is a complicated process. In this paper we will consider only
 continuously activated worms. By this we mean that a worm on an infectious host continuously tries to find
and infect other susceptible hosts, as was the case of the Code Red worm incident of July 19th.

In real world, since hackers write the codes of worms arbitrarily, worms usually don't continuously spread
forever, for example, the Code Red worm stopped propagation at 00:00 UTC July 20th. Any worm models,
including ours, can only model the continuous propagation before that stopping time. We can only predict such
stopping event by manually analyzing the worm code.

In this paper, we consider worms that propagate without the topology constraint, which was the case of Code
Red. Topology constraint means that an infectious host may not be able to directly reach and infect an
arbitrary susceptible host --- it needs to infect several hosts on the route to the target before it can
reach the target. Most worms, such as Code Red, belong to the worms without topology constraint. On the other
hand, email viruses, such as Melissa \cite{Melissa} and Love Bug \cite{Love}, depend on the logical topology
defined by users' email address books to propagate. Their propagations are topology dependent and need to be
modelled by considering the properties of the underlining topology, which will not be discussed in this
paper.

\subsection{Two factors affecting Code Red worm propagation }

By studying reports and papers on the Code Red incident of July 19th, we find that the following two factors,
which are not considered in traditional epidemic models, affected Code Red worm propagation:

\begin{itemize}

\item Human countermeasures result in removing both susceptible and infectious computers from circulation ---
during the course of Code Red propagation, an increasing number of people became aware of the worm and
implemented some countermeasures: cleaning compromised computers, patching or upgrading susceptible
computers, setting up filters to block the worm traffic on firewalls or edge routers, or even disconnecting
their computers from Internet.

\item Decreased infection rate $\beta(t)$, not a constant rate $\beta$ --- the large-scale worm propagation
have caused congestion and troubles to some Internet routers \cite{cisco, cisco2, JamesBGP, Lan02}, thus
slowed down the Code Red scanning process.

\end{itemize}

Human countermeasures, cleaning, patching, and filtering, played an important role in defending against Code
Red worm. Microsoft reported that the IIS Index Server patch was downloaded over one million times by August
1st, 2001 \cite{eweek}. Code Red worm stopped propagation on 00:00 UTC July 20th and was programmed to
reactivate on August 1st. But the scheduled recurrence of the worm on August 1st 2001 was substantially less
damaging than its appearance on July 19th because large number of machines had been patched \cite{cnnnews}.

During the course of Code Red propagation on July 19th, many initially infected machines were patched,
rebooted, or filtered and consequently ceased to probe networks for susceptible hosts \cite{CaidaWeb}. Moore
\textit{et al.} provided  data on the number of deactivated hosts over time \cite{CaidaWeb} (Fig.
\ref{fig:caida2}). A host that was previously infected was considered to be deactivated after the authors of
\cite{CaidaWeb} observed no further unsolicited traffic from it. Figure \ref{fig:caida2} shows that the
number of deactivated hosts kept increasing during the day and the number is not small: Fig. \ref{fig:caida2}
shows that among those $350 000$ infected computers (Fig. \ref{fig:caida1}), more than $150 000$ infected
computers have already been deactivated before Code Red worm ceased propagation at 00:00 UTC July 20th.

The large-scale Code Red worm propagation on July 19th could have caused congestion and troubles to some
Internet routers, thus slowed down the Code Red scanning process. As the Code Red rampantly swept the
Internet on July 19th, more and more computers were infected and then sent out worm scan traffic
continuously. Fig. \ref{fig:caida1} shows that at least $350,000$ computers were infected during that day.
Considering that one infected computer had 99 threads continuously scanning in parallel and there were so
many infected computers on July 19th, the worm propagation would have generated huge number of small scanning
packets. Although the volume of these packets was relatively small compared to the normal Internet traffic,
the huge quantity of these packets could have caused congestion and troubles to some routers, especially edge
routers with limited resources \cite{cisco, cisco2, JamesBGP, Lan02}.

Because Code Red worm generates random IP addresses to scan, many of these IP addresses, for example, some
broadcast IP addresses or unknown addresses, will not be seen or be rarely seen by edge routers when these
routers work under normal conditions. Thus during Code Red rampant spreading on July 19th, the huge quantity
of packets with abnormal destination IP addresses would have caused congestion and troubles to some edge
routers \cite{cisco2}. According to one major router vendor \cite{cisco, cisco2}, the large number of Code
Red scans sent to random IP addresses caused some edge routers to fill up their ARP caches, exhaust their
memories and restart. The high traffic load also triggered the defects in some routers \cite{cisco}, and
caused some low-end routers to reboot.

The decreased worm infection rate and the congestion could also have been caused by the possible ``BGP storm"
\cite{JamesBGP}, although we don't know whether ``BGP storm" really happened or not. \cite{JamesBGP} showed
that there existed strong correlations between BGP message storms and the Code Red and Nimda worm propagation
periods. The global Internet routes became unstable and some autonomous systems had transient route failures
during these BGP storms. However, recently the authors in \cite{Lan02} argued that BGP stood up well during
the worm attack and thus there was no BGP storm happened.

\subsection{A new worm propagation model: two-factor worm model}

In order to account for the slowed down worm scan rate, the infection rate $\beta$ in Eq. (\ref{eq:model1})
must be modeled as a function of time, i.e., $\beta(t)$. From the worm's point of view, human countermeasures
remove some hosts from worm spreading circulation, including both hosts that are infectious and hosts that
are still susceptible. In other words, the removal process consists of two parts: removal of infectious hosts
and removal of susceptible hosts. Let $R(t)$ denote the number of removed hosts from the infectious
population; $Q(t)$ denote the number of removed hosts from the susceptible population. According to the same
principle in deriving the Kermack-Mckendrick model (\ref{eq:KMmodel}), the change in the number of
susceptible hosts $S(t)$ from time $t$ to time $t+\triangle t$ follows the equation:
\begin{equation}
S(t+\triangle t) - S(t) = -\beta(t) S(t)I(t)\triangle t - \frac{dQ(t)}{dt}\triangle t. \label{eq:mymodel1}
\end{equation}
Hence
\begin{equation}
\frac{dS(t)}{dt}=-\beta(t) S(t)I(t)-\frac{dQ(t)}{dt}. \label{eq:mymodel2}
\end{equation}

Note that $S(t)+I(t)+R(t)+Q(t)=N$ holds for any time $t$. Substituting $S(t) = N-I(t)-R(t)-Q(t)$ into Eq.
(\ref{eq:mymodel2}) yields the differential equation describing the behavior of the number of infectious
hosts $I(t)$ as
\begin{equation}
\frac{dI(t)}{dt}=\beta(t)[N-R(t)-I(t)-Q(t)]I(t)-\frac{dR(t)}{dt}. \label{eq:mymodel}
\end{equation}

We refer to the worm model described by Eq. (\ref{eq:mymodel}) as the \textit{two-factor worm} model.

\bigskip

Strictly speaking, worm propagation is a discrete event process. In this paper, However, we treat the worm
propagation as a continuous process and use the continuous differential equation (\ref{eq:mymodel}) to
describe it. Such an approximation is accurate for large-scale system and is widely used in epidemic modeling
\cite{Frauenthal80}, Internet traffic fluid modeling \cite{fluid}, etc. Internet worm propagation is a
large-scale problem so it is suitable to use the continuous differential equation (\ref{eq:mymodel}) to model
it.

In order to solve Eq. (\ref{eq:mymodel}), we have to know the dynamic properties of $\beta(t)$, $R(t)$ and
$Q(t)$. $\beta(t)$ is determined by the impact of worm traffic on Internet infrastructure, and the spreading
efficiency of the worm code; $R(t)$ and $Q(t)$ involve people's awareness of the worm, patching and filtering
difficulties. By specifying their dynamic properties, we can derive the complete set of differential
equations of the two-factor worm model. We will discuss this later in Section 6. In the following Section 5,
we first simulate our two-factor worm model to validate it against the observed Code Red worm propagation
data (Fig. \ref{fig:caida1}).


\section{Simulation of Code Red worm based on two-factor worm model}

\subsection{Description of simulation model}

In the simulation, we model the propagation of the Code Red worm in discrete time. The system in our
simulation consists of $N$ hosts that can reach each other directly, thus there is no topology issue in our
simulation. A host stays in one of three states at any time: susceptible, infectious, or removed. A host is
in ``removed" state when it is immunized, no matter whether it is previous infected or susceptible. Thus the
state transition of any host can be: ``susceptible $\rightarrow$ infectious $\rightarrow$ removed" or
``susceptible $\rightarrow$ removed". At the beginning of simulation, several hosts are initially infectious
and the others are all susceptible.

Each copy of the worm on an infectious host sends out a sequence of infection attempts during its lifetime.
At each infection attempt, the worm randomly chooses another host in the population to infect. The infection
delay time between two consecutive infection attempts represents the time required by a Code Red worm to find
a Windows IIS server through random IP scans (regardless of whether the host is already infected or still
susceptible). An infected host will not change its infection behavior if it is infected again by other copies
of the worm.

To capture the cleaning, patching and filtering impacts on the worm propagation, we dynamically immunize some
hosts in our simulation: at each discrete time $t$ we randomly choose some non-immunized hosts to immunize
regardless of whether they are infectious or still susceptible. The total number of hosts that have been
infected by time $t$, $J(t)$, including both infectious hosts and those previously infected hosts that have
been immunized before $t$, is a monotonically increasing function of time $t$. Let $C(t)$ denote the total
number of removed hosts. We run the immunization process at each discrete simulation time $t$ such that \be
C(t)=aJ(t) \ee where $0\leq a<1$.

We vary the infection delay time $D(t)$ to capture the slowed down worm infection process. Let $p(t)=J(t)/N$
and $X(t)$ be a random variable such that \be X(t) \sim N(k_1p(t)^n, k_2p(t)^n) \label{eq:normal}\ee where
$N(\mu,\sigma^2)$ is the normal distribution with mean value $\mu$ and variance $\sigma^2$; $k_1,k_2,n$ are
model parameters.

In our simulation, we use the following equation to generate the infection delay time $D(t)$ for each worm
copy:
\begin{equation}
D(t)=D(0)+ Y(t), \label{eq:simul2}
\end{equation}
where $D(0)$ is the base infection delay time and $Y(t)$ is derived by \be Y(t)=\left\{
\begin{array}{ll}
\lfloor X(t) \rfloor    &  X(t) > 0 \\
0       &  X(t) < 0   \\
\end{array}
\right. \ee

The normal distribution here is used to simulate the randomness in the scan process of each worm copy. The
power exponent $n$ in (\ref{eq:normal}) is used to adjust the sensitivity of the infection delay time $D(t)$
to the number of infected hosts $J(t)$.

\subsection{Simulation experiments}

We simulate four scenarios. The first one is the classical simple epidemic model (\ref{eq:model1}), the same
as used in \cite{StanifordWeb} and \cite{HeberleinWeb, Wang00, WeaverWeb}. It does not consider the two
factors discussed in this paper and can be simulated from our model by letting $D(t)=D(0)$ and $a=0$. In the
second scenario, we consider only the decreased infection rate by using $a=0$ and $D(t)$ as in
(\ref{eq:simul2}). In the third scenario, we consider the effects of patching and filtering but with constant
infection rate by using $D(t)=D(0)$ and $a=0.5$. In the last scenario we use the two-factor worm model,
allowing both immunization and decreased infection rate, i.e., $D(t)$ as in (\ref{eq:simul2}) and $a=0.5$.
For each scenario, we run the simulation 100 times and derive the mean value of the number of infected hosts
at each time $t$, $E[J(t)]$. The $E[J(t)]$ of these four scenarios are plotted in Fig. \ref{fig:compare1} as
functions of time $t$ (The other simulation parameters are: $N=1 000 000$, $D(0)=10$,$k_1=150$, $k_2=70$,
$n=2$; 10 initially infected hosts).

\begin{figure*}[t]
\centering{\begin{minipage}[b]{.40\linewidth}
\centering\epsfig{file=compare4.eps,width=\linewidth}\caption{Code Red worm simulation based \newline on
different models.} \label{fig:compare1}
\end{minipage} \hspace{50pt}
\begin{minipage}[b]{.30\linewidth}
\centering\epsfig{file=caida.eps,width=\linewidth}\caption{Number of infected hosts (from caida.org)}
\label{fig:caidaAll}
\end{minipage}}
\end{figure*}

For the purpose of comparison, we plot the Fig. \ref{fig:caida1} again right beside our simulation results
Fig. \ref{fig:compare1}. Comparing our two-factor worm model simulation curve (the blue solid line in Fig.
\ref{fig:compare1}) with the observed Code Red data in Fig. \ref{fig:caidaAll}, we observe that, by
considering the removal processes and the worm decreased infection rate, we can match the observed data
better than the original Code Red worm simulation (the black dotted line in Fig. \ref{fig:compare1}). In the
beginning, the number of infected hosts, $J(t)$, increases exponentially. However, the propagation speed
decreases when the total number of infected hosts reaches only about 50\% of the population. The decreasing
of propagation speed happens much earlier than the original Code Red simulation. For future Internet worms,
by adjusting the parameters in our simulation, we can adjust the curve to match real data and then understand
more of the characteristics of the worms we investigate.

\bigskip
We further investigate how variable each simulation is among the 100 simulation runs of the two-factor model.
By using the maximum and minimum values for the number of infected hosts at each time $t$, we derive two
envelope curves that contain all these 100 curves. These two envelope curves are so close to each other that
we can't distinguish them from a figure. The maximum difference between these two curves is only $0.227\%$ to
the population size $N$. In other words, the worm propagation is almost a deterministic process
--- it's the reason why we can use deterministic differential equation (\ref{eq:mymodel}) to model large-scale
Internet worm propagation, which is essentially a stochastic process.

The reason why random events have so little effect on the worm propagation is that the population is huge (1
million hosts) and each worm copy infects others independently. From the whole worm propagation point of
view, these huge number of random events will eventually average out each other.

\section{Numerical analysis of the two-factor worm model}

The two-factor worm model (\ref{eq:mymodel}) is a general worm model with several undetermined dynamic
parameters $\beta(t)$,$R(t)$ and $Q(t)$. If we assume the infection rate $\beta(t)$ to be constant and do not
consider the removal process from susceptible population, i.e., $Q(t)=0$, we derive exactly the
Kermack-Mckendrick model (\ref{eq:KMmodel}) when $R(t)=\gamma I(t)$ \cite{Bailey75}. For the general
two-factor worm model, we can't get closed-form analytical solutions. Instead, we analyze the model based on
the numerical solutions of the differential equation  by using Matlab Simulink \cite{simulink} .

First we need to determine the dynamical equations describing $R(t)$,$Q(t)$ and $\beta (t)$ in the two-factor
worm model (\ref{eq:mymodel}). For the removal process from infectious hosts, we use the same assumption as
what Kermack-McKendrick model uses:
\begin{equation}
\frac{dR(t)}{dt} = \gamma I(t). \label{eq:Rt_dynamic}
\end{equation}

The removal process from susceptible hosts is more complicated. At the beginning of the worm propagation,
most people don't know there exists such a kind of worm. Consequently the number of removed susceptible hosts
is small and increases slowly. As more and more computers are infected, people gradually become aware of this
worm and the importance of defending against it. Hence the speed of immunization increases fast as time goes
on. The speed decreases as the number of susceptible hosts shrinks and converges to zero when there are no
susceptible hosts available.

From the above description, the removal process of the susceptible hosts looks similar to a typical epidemic
propagation. Thus we will use the classical simple epidemic model (\ref{eq:model1}) to model it:
\begin{equation}
\frac{dQ(t)}{dt} = \mu S(t)J(t). \label{eq:Qt_dynamic}
\end{equation}

Last, we model the decreased infection rate $\beta(t)$ by the equation:
\begin{equation}
\beta(t) = \beta_0 [1 - \frac{I(t)}{N}]^\eta, \label{eq:Beta_dynamic}
\end{equation}
where $\beta_0$ is the initial infection rate. The exponent $\eta$ is used to adjust the infection rate
sensitivity to the number of infectious hosts $I(t)$. $\eta = 0$ means constant infection rate.

Using the assumptions above on $Q(t)$, $R(t)$ and $\beta(t)$, we write down the complete differential
equations of the two-factor worm model:
\begin{equation}
\left\{
\begin{array}{rl}
dS(t)/dt        =&  -\beta(t)S(t)I(t) - dQ(t)/dt \\
dR(t)/dt        =&  \gamma I(t)   \\
dQ(t)/dt        =&  \mu S(t)J(t)    \\
\beta(t)        =&  \beta_0[1-I(t)/N]^\eta   \\
 N              =&  S(t)+I(t)+R(t)+Q(t)\\
 I(0)           =&I_0 \ll N; S(0) = N-I_0; R(0)=Q(0)=0;
\end{array}
\right.
 \label{eq:modelequations}
\end{equation}

For parameters $N=1,000,000$, $I_0=1$, $\eta=3$, $\gamma= 0.05$, $\mu =0.06/N$, and $\beta_0=0.8/N$, we
obtain the numerical solutions of two-factor worm model (\ref{eq:modelequations}) and plot them in Fig.
\ref{fig:simul-1}. The figure illustrates the behavior of $J(t)=I(t)+R(t)$, $I(t)$, and $Q(t)$ as functions
of time $t$. For comparison, we also plot the number of infected hosts $J(t)$ of the classical simple
epidemic model (\ref{eq:model1}) in this figure. The classical simple epidemic model (\ref{eq:model1}) can be
derived from the two-factor worm model (\ref{eq:modelequations}) by simply setting $\eta=0$, $\gamma=0$, and
$\mu=0$.

\begin{figure}[h]
\centering\epsfig{file=numerical.eps,width=.95\linewidth} \caption{Numerical solution of two-factor worm
model} \label{fig:simul-1}
\end{figure}

Comparing the two-factor model solution $J(t)$ in Fig. \ref{fig:simul-1} with the number of infected hosts in
our Code Red worm simulation Fig. \ref{fig:compare1}, we can see that they are consistent and well matched.

Figure \ref{fig:simul-1} shows that the number of infectious hosts $I(t)$ reaches its maximum value at
$t=29$. From then on it decreases because the number of removed infectious hosts in a unit time is greater
than the number of newly generated infectious hosts at the same time.

We can explain this phenomenon by analyzing the two-factor model equation (\ref{eq:modelequations}). From
(\ref{eq:modelequations}) we can derive
\begin{equation}
\begin{array}{rcl}
dI(t)/dt &=& \beta(t)S(t)I(t) - dR(t)/dt \\
                 &=& [\beta(t)S(t)-\gamma]I(t)
\end{array}
\label{eq:I_t_slow}
\end{equation}

\begin{figure*}[t]
\centering{
\begin{minipage}{.40\linewidth}
\centering\epsfig{file=uniqueIPDaveKen.eps,width=\linewidth} \caption{Observed Code Red scan unique sources
hour-by-hour} \label{fig:uniqueIPDaveKen}
\end{minipage} \hspace{50pt}
\begin{minipage}{.40\linewidth}
\centering\epsfig{file=modelCompareDaveKen.eps,width=\linewidth} \caption{Comparison between observed data
and our model} \label{fig:modelCompareDaveKen}
\end{minipage}}
\end{figure*}

The  number of susceptible hosts, $S(t)$, is a monotonically decreasing function of time. The maximum number
of infectious hosts, $\max I(t)$, will be reached at time $t_c$ when $S(t_c)=\gamma/\beta(t_c)$.
$\beta(t)S(t)-\gamma < 0$ for $t>t_c$, thus $I(t)$ decreases after $t>t_c$.

The behavior of the number of infectious hosts $I(t)$ in Fig. \ref{fig:simul-1} can explain why the Code Red
scan attempts dropped down during the last several hours of July 19th \cite{KenData, DaveData}. The data
collected by Smith \cite{DaveData} and Eichman \cite{KenData} contain the number of the Code Red infectious
sources that sent out scans during each hour. It tells us how many computers were still infectious during
each hour on July 19th, thus the number of observed infectious sources corresponds to $I(t)$ in our model. We
plot the average values of these two data sets in Fig. \ref{fig:uniqueIPDaveKen}.

We plot in Fig. \ref{fig:modelCompareDaveKen} both the observed data in Fig. \ref{fig:uniqueIPDaveKen} and
the $I(t)$ derived from our model as shown in Fig. \ref{fig:simul-1} (we use the observed data from July 19th
12:00 to 00:00 UTC. Code Red worm stopped propagation after 00:00 UTC July 20th). Figure
\ref{fig:modelCompareDaveKen} shows that they are matched quite well. The classical simple epidemic model
(\ref{eq:model1}) can't explain the dropping down of Code Red propagation during the last several hours of
July 19th.

From the simple epidemic model (Fig. \ref{fig:model2}) and observed data (Fig. \ref{fig:DataSet2}), the
authors in \cite{StanifordWeb} concluded that Code Red came to saturating around 19:00 UTC July 19th ---
almost all susceptible IIS servers online on July 19th have been infected around 19:00 UTC. However, the
numerical solution of our model, as shown in Fig. \ref{fig:simul-1}, shows that only roughly 60\% of all
susceptible IIS servers online have been infected around that time.


\section{Conclusion}

In this paper, we present a more accurate Internet worm model and use it to model Code Red worm propagation.
Since Internet worms are similar to viruses in epidemic research area, we can use epidemic models to model
Internet worms. However, epidemic models are not accurate enough. They can't capture some specific properties
of Internet worms. By checking the Code Red worm incident and networks properties, we find that there are two
major factors that affect an Internet worm propagation: one is the effect of human countermeasures against
worm spreading, like cleaning, patching, filtering or even disconnecting computers and networks; the other is
the slowing down of worm infection rate due to worm's impact on Internet traffic and infrastructure. By
considering these two factors, we derive a new general Internet worm model called \textit{two-factor worm}
model. The simulations and the numerical solutions of the two-factor worm model show that the model matches
well with the observed Code Red worm data of July 19th 2001.

In our two-factor worm model, the increasing speed of the number of infected hosts will begin to slow down
when only about 50\% of susceptible hosts have been infected. It explains the earlier slowing down of the
Code Red infection in July 19th (Fig. \ref{fig:caida1}). The number of current infected hosts $I(t)$ in Fig.
\ref{fig:simul-1} matches the corresponding observed data \cite{KenData, DaveData} quite well as shown in
Fig. \ref{fig:modelCompareDaveKen}. It explains why Code Red scans dropped down during the last several hours
of July 19th, while previous worm models can't explain such phenomenon.

Due to the two factors that affect an Internet worm propagation, the exponentially increased propagation
speed is only valid for the beginning phase of a worm. If we use the traditional epidemic model to do a worm
prediction, we will always overestimate the spreading and damages of the worm.

The two-factor worm model is a general Internet worm model for modeling worms without topology constraint. It
isn't just a specific model for Code Red. The slowing down of worm infection rate will happen when the worm
rampantly sweeps the whole Internet and causes some troubles to the Internet traffic and infrastructure, like
what Code Red worm and Nimda worm did \cite{cisco, JamesBGP, Lan02}. Human countermeasures, like cleaning,
patching, filtering, or disconnecting computers, play a major role in all kinds of viruses or worms
propagations no matter how fast or slow these viruses or worms propagate. Human countermeasures will
successfully slow down and eventually eliminate viruses or worms propagation. In real world, there are many
viruses and worms coming out almost every day, but few of them show up and propagate seriously on Internet.
Eventually all of them pass away due to human countermeasures. Most viruses and worms are not so contagious
as Code Red and Nimda. After the cleaning and patching rate exceeds the viruses or worms propagation rate,
those viruses and worms will gradually disappear from the Internet circulation.

However, Internet worm models have their limitations. For example, the two-factor worm model as well as other
worm models are only suitable for modeling a continuously spreading worm, or the continuously spreading
period of a worm. They can't predict those arbitrary stopping or restarting events of a worm, such as the
stopping of Code Red propagation on 00:00 UTC July 20th 2002 and its restarting on August 1st --- we can only
find such events through manually code analysis.

In our two-factor worm model (\ref{eq:modelequations}), we select parameters, $\gamma$, $\mu$, $\beta_0$, $n$
and $\eta$, such that the numerical solutions can match with the observed Code Red data. Even for the simple
epidemic model (\ref{eq:model1}), we still need to determine the parameter $\beta$ before using it. For the
prediction and damage assessment of future viruses and worms, we need to do more research to find an
analytical way to determine these parameters beforehand.

\bibliographystyle{abbrv}
%\bibliography{codered}
\begin{thebibliography}{10}

\bibitem{Anderson91} R. M. Anderson, R.M. May. Infectious diseases of humans: dynamics and control. Oxford
University Press, Oxford, 1991.

\bibitem{Andersson00} H. Andersson, T. Britton. Stochastic Epidemic Models and Their Statistical
Analysis.  Springer-Verlag, New York, 2000.

\bibitem{Bailey75} N. T. Bailey. The Mathematical Theory of Infectious Diseases and its Applications.
  Hafner Press, New York, 1975.

\bibitem{CertCodeRedWeb} CERT Advisory CA-2001-23. Continued Threat of the ``Code Red" Worm.
  {\texttt http://www.cert.org/advisories/CA-2001-23.html}

\bibitem{Love} CERT Advisory CA-2000-04. Love Letter Worm.
  {\texttt http://www.cert.org/advisories/CA-2000-04.html}

\bibitem{Melissa} CERT Advisory CA-1999-04. Melissa Macro Virus.
  {\texttt http://www.cert.org/advisories/CA-1999-04.html}

\bibitem{cisco} Cisco Security Advisory: ``Code Red" Worm - Customer Impact.
  {\texttt http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.shtml}

\bibitem{cisco2} Cisco Tech. notes: Dealing with mallocfail and High CPU Utilization Resulting
From the ``Code Red" Worm.
  {\texttt http://www.cisco.com/warp/public/63/

  ts\_codred\_worm.shtml}

\bibitem{cnnnews} CNN news. ``Code Red" worm ``minimized" -- for now.
  {\texttt http://www.cnn.com/2001/TECH/internet

  /08/02/code.red.worm/}

\bibitem{JamesBGP} J. Cowie, A. Ogielski, B. Premore and Y. Yuan.
    Global Routing Instabilities during Code Red II and Nimda Worm Propagation.
  {\texttt http://www.renesys.com/projects/bgp\_instability/}

\bibitem{eeyeWeb} eEye Digital Security. .ida ``Code Red" Worm.
   {\texttt http://www.eeye.com/html/Research/Advisories/

   AL20010717.html}

\bibitem{eeyeWeb2} eEye Digital Security. CodeRedII Worm Analysis.
   {\texttt http://www.eeye.com/html/Research/Advisories/

   AL20010804.html}

\bibitem{KenData} K. Eichman. Mailist: Re: Possible CodeRed Connection Attempts.
    {\texttt http://lists.jammed.com/incidents/2001/07/0159.html}

\bibitem{eweek} eWeek news. Code Red Lessons, Big and Small.
   {\texttt http://www.eweek.com/article2/0,3959,113815,00.asp}

\bibitem{Frauenthal80} J. C. Frauenthal. Mathematical Modeling in Epidemiology.
Springer-Verlag, New York, 1980.

\bibitem{DaveData} D. Goldsmith. Maillist: Possible CodeRed Connection Attempts.
  {\texttt http://lists.jammed.com/incidents/2001/07/0149.html}

\bibitem{HeberleinWeb} T. Heberlein. Visual simulation of Code Red worm propagation patterns.
   {\texttt http://www.incidents.org/archives/intrusions/

   msg00659.html}

\bibitem{IncidentsWeb} Incidents.org diary archive.
 {\texttt http://www.incidents.org/diary/july2001.php}

\bibitem{Netcraft} Netcraft Web Server Survey --- June 2001.
  {\texttt http://www.netcraft.com/Survey/index-200106.html}

\bibitem{IBM1} J. O. Kephart and S. R. White. Directed-graph Epidemiological Models of Computer Viruses.
   {\em Proceedings of the IEEE Symposimum on Security and Privacy}, 343-359, 1991.

\bibitem{IBM2} J. O. Kephart, D. M. Chess and S. R. White. Computers and Epidemiology.
 {\em IEEE Spectrum}, 1993.

\bibitem{IBMmodel} J. O. Kephart and S. R. White. Measuring and Modeling Computer Virus Prevalence.
   {\em Proceedings of the IEEE Symposimum on Security and Privacy}, 1993.

\bibitem{cnetNews2} R. Lemos. Virulent worm calls into doubt our ability to protect the Net.
  {\texttt http://news.com.com/2009-1001-270471.html}

\bibitem{Cnetnews1} R. Lemos. Microsoft reveals Web server hole.
    {\texttt http://news.com.com/2100-1001-268608.html}

\bibitem{simulink} Matlab Simulink. The Mathworks, Inc.

\bibitem{fluid} V. Misra, W. Gong and D. Towsley. A fluid based analysis of a network of AQM routers
supporting TCP flows with an application to RED. {\em Proceedings of ACM/SIGCOMM}, 151-160, 2000.

\bibitem{CaidaWeb} D. Moore. The Spread of the Code-Red Worm.
  {\texttt http://www.caida.org/analysis/security/code-red/coderedv2\_analysis.xml}

\bibitem{SymantecThreat} C. Nachenberg. The Evolving Virus Threat.
  {\em 23rd NISSC Proceedings}, Baltimore, Maryland, 2000.

\bibitem{SilentBladeWeb} SilentBlade. Info and Analysis of the 'Code Red'.

    {\texttt http://www.securitywriters.org/library/texts/

    malware/commu/codered.php}

\bibitem{MorrisWorm} E.H. Spafford. The internet worm incident. In
 {\em ESEC'89 2nd European Software Engineering Conference}, Coventry, United Kingdom, 1989.

\bibitem{StanifordWeb} S. Staniford, V. Paxson and N. Weaver. How to Own the Internet in Your Spare Time.
{\em 11th Usenix Security Symposium}, San Francisco, August, 2002.

\bibitem{Wang00} C. Wang, J. C. Knight and M. C. Elder. On Viral Propagation and the Effect of Immunization.
  {\em Proceedings of 16th ACM Annual Computer Applications Conference}, New Orleans, LA, 2000.

\bibitem{Lan02} L. Wang, X. Zhao, D. Pei, R. Bush, D. Massey, A. Mankin, S. Wu and L. Zhang. Observation and
Analysis of BGP Behavior under Stress. {\em Internet Measurement Workshop}, France, November, 2002.

\bibitem{WeaverWeb} N. Weaver. Warhol Worms:  The Potential for Very Fast Internet Plagues.
 {\texttt http://www.cs.berkeley.edu/\~{}nweaver/warhol.html}

\end{thebibliography}
\end{document}
