DMCA
Code-Red: a case study on the spread and victims of an Internet worm (2002)
| Citations: | 337 - 6 self |
BibTeX
@INPROCEEDINGS{Moore02code-red:a,
author = {David Moore and Colleen Shannon and k claffy},
title = {Code-Red: a case study on the spread and victims of an Internet worm},
booktitle = {},
year = {2002},
pages = {273--284}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
On July 19, 2001, more than 359,000 computers connected to the Internet were infected with the CodeRed (CRv2) worm in less than 14 hours. The cost of this epidemic, including subsequent strains of Code-Red, is estimated to be in excess of $2.6 billion. Despite the global damage caused by this attack, there have been few serious attempts to characterize the spread of the worm, partly due to the challenge of collecting global information about worms. Using a technique that enables global detection of worm spread, we collected and analyzed data over a period of 45 days beginning July 2nd, 2001 to determine the characteristics of the spread of Code-Red throughout the Internet. In this paper, we describe the methodology we use to trace the spread of Code-Red, and then describe the results of our trace analyses. We first detail the spread of the Code-Red and CodeRedII worms in terms of infection and deactivation rates. Even without being optimized for spread of infection, Code-Red infection rates peaked at over 2,000 hosts per minute. We then examine the properties of the infected host population, including geographic location, weekly and diurnal time effects, top-level domains, and ISPs. We demonstrate that the worm was an international event, infection activity exhibited time-of-day effects, and found that, although most attention focused on large corporations, the Code-Red worm primarily preyed upon home and small business users. We also qualified the effects of DHCP on measurements of infected hosts and determined that IP addresses are not an accurate measure of the spread of a worm on timescales longer than 24 hours. Finally, the experience of the CodeRed worm demonstrates that wide-spread vulnerabilities in Internet hosts can be exploited quickly and dramatically, and t...
Keyphrases
case study internet worm codered worm accurate measure deactivation rate coderedii worm time-of-day effect worm spread international event infection activity infected host population global information global damage geographic location small business user top-level domain serious attempt ip address code-red worm global detection diurnal time effect wide-spread vulnerability infected host large corporation internet host code-red infection rate trace analysis subsequent strain
