An analysis of the witty outbreak: exploiting underlying structure for detailed reconstruction of an internet-scale event

ABSTRACT

In this talk we discuss an analysis of the propagation in March 2004 of the "Witty" worm, which infected more than 12,000 hosts worldwide in 75 minutes. We show that by carefully exploiting the structure of the worm, especially its pseudo-random number generation, from limited and imperfect telescope data we can recover a wealth of information with high fidelity. The corresponding paper, coauthored with Abhishek Kumar and Nicholas Weaver, appears in the Proceedings of the 2005 ACM Internet Measurement Conference.