Comparative study between analytical models and packet-level worm simulations

The threat of Internet worms has been, and continues to be, one of the most important issues faced by networking researchers and network users. The need for accurate and efficient modeling and analysis methods cannot be understated. Models that accurately reflect the behavior of existing and yet-to-be deployed worms is critical to understanding how to deal with this ongoing threat. Recently developed analytical models, have been used to generate propagation trends that match with historic worm outbreaks. However in this effort, the values used for some of the parameters are different from empirically measured information, such as probe rate per unit IP address space. Although not found in simpler models, new analytical models are under development that can take into account various network and worm characteristics. But in order to build and test them accurately real world data has been used. In our work, we have focused on packet-level detail in the simulation models, which can take into account realistic network characteristics that include, queuing delay, packet-loss, link delays and also realistic worm characteristics at the expense of additional computational complexity. Using our simulator we show how it can be a useful tool in analyzing and evaluating analytical worm models. We study the worm propagation pattern predicted by one particular analytical model and compare it to our packet-level simulations.