NSME: a framework for network worm modeling and simulation

Abstract

Various worms have a devastating impact on Internet. Packet level network modeling and simulation has become an approach to find effective countermeasures against worm threat. However, current alternatives are not fit enough for this purpose. For instance, they mostly focus on the details of lower layers of the network so that the abstraction of application layer is very coarse. In our work, we propose a formal description of network and worm models, and define network virtualization levels to differentiate the expression capability of current alternatives. We then implement a framework, called NSME, based on NS2 for dedicated worm modeling and simulation with more details of application layer. We also analyze and compare the consequential overheads. The additional real-time characteristics and a worm simulation model are further discussed.