Hybrid Epidemics - A Case Study on Computer Worm Conficker

TL;DR

This paper models the Conficker worm's hybrid spreading strategies using a mathematical framework, revealing how combined modes influence epidemic success and implications for internet security.

Contribution

It introduces a novel mathematical model capturing the hybrid spreading behavior of Conficker and analyzes the effectiveness of combined transmission modes.

Findings

Conficker's spreading is a critically hybrid epidemic.

Isolated spreading modes are insufficient for large-scale epidemics.

Hybrid strategies can be exploited for effective information dissemination or pose security threats.

Abstract

Conficker is a computer worm that erupted on the Internet in 2008. It is unique in combining three different spreading strategies: local probing, neighbourhood probing, and global probing. We propose a mathematical model that combines three modes of spreading, local, neighbourhood and global to capture the worm's spreading behaviour. The parameters of the model are inferred directly from network data obtained during the first day of the Conifcker epidemic. The model is then used to explore the trade-off between spreading modes in determining the worm's effectiveness. Our results show that the Conficker epidemic is an example of a critically hybrid epidemic, in which the different modes of spreading in isolation do not lead to successful epidemics. Such hybrid spreading strategies may be used beneficially to provide the most effective strategies for promulgating information across a large population. When used maliciously, however, they can present a dangerous challenge to current internet security protocols.