Coping with Instant Messaging Worms - Statistical Modeling and Analysis

Due to the real time nature and presence information of instant messaging (IM) system, worms spread over IM networks more rapidly than Internet/E-mail worms. Modeling is an indispensable process for coping with them. Most of existing worm modeling techniques are based on deterministic biological epidemiology. Epidemic models only capture the expected worm behavior quantitatively and may not be adequate to model the early phase of worm propagation when the number of infected hosts is small. In this paper, we present a statistical branching process for modeling IM worms. By introducing stochastic variables for user response time in IM worm modeling, we are able to conduct more accurate and sophisticated analysis of worm's behaviors, especially for the early phase of worm propagation. The analysis provides a guideline on how to defend against IM worms.