Analysis of Routing Worm Infection Rates on an IPV4 Network

Malicious logic, specifically worms cost network users an enormous amount of time and money. Worms, like Slammer and Code Red, infect thousands of systems and denied whole networks access to the Internet. This research examines the ability of the original Slammer worm, a Slammer based routing worm, and a new Single Slash Eight (SSE) routing worm to infect vulnerable systems within a given address space. The ability of Slammer to generate a uniform random IP addresses in a given address space is established. Finally, a comparison of the speed increase from a worm on a computing system in 2003 to those available today is performed. Both the Slammer based routing worm and the SSE routing worm spread faster than the original Slammer. The random number generator of the original Slammer worm generates a statistically uniform distribution of addresses within the range under test. Furthermore, despite the previous research into the speed of worm propagation, there is still a need to test worms on the current systems. The speed of the computing systems that the worms operated on in the past were more than three times slower than today's systems. As the speed of computer systems continue to grow, the speed of worm propagation should increase with it as their scan rates directly relate to their infection rate. As such, any inherent immunity of an IPv6 network from scanning worms should be reexamined.