SIRS: Internet Worm Propagation Model and Application

Internet worms spread fast and destroy strong. An accurate Internet worm model provides insight into worm propagation. It aids in identifying the characteristics in the worm spreading and provides better detection and prevention for a new worm threat. In this paper, based on the classical Kermack-Mckendrick model, we propose a general Internet worm model called SIRS (Susceptible -- Infectious -- Removed -- Susceptible) worm model by accounting for two aspects: one is the increased worm removal rate, the other is that the partial removed hosts become susceptible hosts again due to users' weak secure awareness. Simulation results of the SIRS worm model match the observed data of Code-Red worm pretty well. This model leads to a better understanding and prediction of the scale and speed of Internet worm spreading, and provides effective measures to control the spread of Internet worms.