Zhang Changwang, Zhou Shi, Chain Benjamin M
Department of Computer Science, University College London, London, United Kingdom; Security Science Doctoral Research Training Centre, University College London, London, United Kingdom.
Department of Computer Science, University College London, London, United Kingdom.
PLoS One. 2015 May 15;10(5):e0127478. doi: 10.1371/journal.pone.0127478. eCollection 2015.
Conficker is a computer worm that erupted on the Internet in 2008. It is unique in combining three different spreading strategies: local probing, neighbourhood probing, and global probing. We propose a mathematical model that combines three modes of spreading: local, neighbourhood, and global, to capture the worm's spreading behaviour. The parameters of the model are inferred directly from network data obtained during the first day of the Conficker epidemic. The model is then used to explore the tradeoff between spreading modes in determining the worm's effectiveness. Our results show that the Conficker epidemic is an example of a critically hybrid epidemic, in which the different modes of spreading in isolation do not lead to successful epidemics. Such hybrid spreading strategies may be used beneficially to provide the most effective strategies for promulgating information across a large population. When used maliciously, however, they can present a dangerous challenge to current internet security protocols.
“康菲克”是一种于2008年在互联网上爆发的计算机蠕虫病毒。它独特之处在于结合了三种不同的传播策略：本地探测、邻域探测和全球探测。我们提出了一个数学模型，该模型结合了三种传播模式：本地、邻域和全球，以捕捉蠕虫病毒的传播行为。模型参数直接从“康菲克”疫情爆发首日获取的网络数据中推断得出。然后，该模型用于探索传播模式之间的权衡在决定蠕虫病毒有效性方面的作用。我们的结果表明，“康菲克”疫情是一种临界混合疫情的实例，其中孤立的不同传播模式不会导致成功的疫情。这种混合传播策略可能会被有益地用于提供在大量人群中传播信息的最有效策略。然而，当被恶意使用时，它们会对当前的互联网安全协议构成危险挑战。
