H2P: A Novel Model to Study the Propagation of Modern Hybrid Worm in Hierarchical Networks

Network worms have become a critical security threat to the Internet in recent years. Due to highly non-uniform distribution of vulnerable hosts and the wide application of NAT technique, they restrain the spread of traditional scan-based worm to some extent. With the rapid growth of social software, worms can spread from physical networks to social networks. Though social worms fix scanning worm deficiencies, it cannot hit some hosts not in social networks because of the dependence on the topological structure. Modern hybrid worm combines the advantages of two types of worms. On the one hand, it makes use of important scanning which results from Important Sample in statistics that scan IP-address space. On the other hand, it exploits a reinfection-trigger mechanism in social networks. Because of the potential damages, it is important for us to gain a deep understanding of the propagation dynamics of modern hybrid worm. In this paper, we present an analytical Hierarchical-Hybrid Propagation (H2P) model for characterizing worm propagation. We perform comprehensive theoretical analyses and experimental evaluation to validate our simulation model. The results show that our model presented in this paper achieves a greater accuracy in characterizing the propagation of modern hybrid worms.