1

2

Code Red 2 killsoff Code Red 1

Code Red 2 settlesinto weekly pattern

Nimda enters theecosystem

Code Red 2 dies offas programmed

CR 1returnsthanksto badclocks

Code Red 2 dies offas programmed

Nimda hums along,slowly cleaned up

With its predatorgone, Code Red 1comes back!, stillexhibiting monthlypattern

3

Modeling Worm Spread• Often well described as infectious epidemics

– Simplest model: homogeneous random contacts

• Classic SI model– N: population size– S(t): susceptible hosts at time t– I(t): infected hosts at time t– β: contact rate– i(t): I(t)/N, s(t): S(t)/N N

IS

dt

dS

N

IS

dt

dI

!

!

"=

=

)1( iidt

di!= "

)(

)(

1)(

Tt

Tt

e

eti

!

!

+=

"

"

The Usual Logistic Growth

4

Slammerʼs Bandwidth-Limited Growth

80% of Code Red 2cleaned up due toonset of Blaster

Code Red 2 re-released with Oct.2003 die-off

Code Red 1 andNimda endemic

Code Red 2 re-re-released Jan 2004(and 2005; not since)

Code Red 2dies offagain

5

Courtesy Mikko Hypponen

6

F-Secure’sHelsinki Lab

7

8

9

10