Fig 1.
Hybrid epidemics, where two spreading mechanisms A and B are mixed at the ratio of α to (1 − α), where 0 ≤ α ≤ 1.
(a) Non-critically hybrid epidemic, where at least one of the two mechanisms can cause an outbreak by its own (i.e. when α = 1 or α = 0). (b) critically hybrid epidemics, where each mechanism alone cannot cause any significant infection whereas a mix of them produces an epidemic outbreak. There exists an optimal α that produces the maximum outbreak.
Fig 2.
Conficker’s three probing strategies.
(1) global spreading, where it probes any computer on the Internet at random; (2) local spreading, where it probes computers in the same local network; (3) neighbourhood spreading, where it probes computers in ten neighbouring local networks.
Fig 3.
Numbers of susceptible nodes S(t), infected nodes I(t) and recovered nodes R(t) as a function of time t, as inferred from CAIDA’s dataset on 21/Nov/2008, the day of Conficker’s outbreak.
Fig 4.
Numbers of nodes newly infected by Conficker via each of the three spreading mechanisms in 10-minute windows on the day of Conficker’s outbreak, as inferred from CAIDA’s dataset on 21/Nov/2008.
Table 1.
Conficker parameters inferred from data1.
Fig 5.
The outbreak of computer worm Conficker.
Points are measured from Network Telescope’s dataset collected on the outbreak day. Curve is theoretical prediction from our Conficker model using the inferred parameters.
Fig 6.
Simulation results for the mix of Conficker’s two spreading mechanisms with different mixing probabilities.
(a) Mix of global (αg) and local (1 − αg) mechanisms; (b) Mix of global (αg) and neighbourhood (1-αg) mechanisms; (c) Mix of local (αl) and neighbourhood (1-αl) mechanisms. In each case we measure the outbreak size, the total duration of the spreading, and the speed of spreading. The outbreak results include both the final outbreak size (square) and the outbreak size at time step 100 (filled circle). Each data point is averaged over 100 runs of a simulation. Note the y axes are all logarithmic.
Fig 7.
Simulation results when three of Conficker’s spreading mechanisms are mixed at different probabilities.
Spreading properties shown include the final outbreak size, the survival time and the spreading speed (see colour maps) as functions of the mixing probabilities of global spreading αg (x axis) and local spreading αl (y axis), where the mixing probability of neighbourhood spreading is αn = 1 − αg − αl.
Fig 8.
Predicted numbers of susceptible, infected and recovered nodes at 16:00 on the outbreak day as a function of the recovery time τ, which is the average time for an infected node to recover.
Conficker’s recovery time is 156 minutes.