VACCINE: War of the Worms in Wired and Wireless Networks

The highlight of worm outbreaks in 2004 was a new phenomenon called ‘War of the Worms’ between NetSky, Bagle and MyDoom worm variants. Their aftermaths caused the record-high of 12 outbreaks in first quarter alone. This war created complex interactions among worms referring to one worm terminating another worm. In this paper, we try to answer the following questions: How much does this scenario affect individual worm propagation?, How can one worm win this war?, How do other factors such as mobility and protocol affect worm interaction? And how can we use worms as a defense mechanism? We propose a new worm propagation model (based upon and extending beyond the epidemic model) focusing on worm interaction, which dramatically alters the phase transition characteristics of single-type worm propagation. We validate our worm interaction model using realistic data and extensive ns-2 simulations. This study provides the first work to compare worm propagation and interaction of multiple types of worms in wired and wireless networks. The main finding of this study is that for worms to survive, they must terminate each other with balanced speed. Based on this study, we believe there is great potential for a new security paradigm to use non-malicious worms to fight malicious worms in what is similar to network vaccination.