Computer Science Technical Report Archive

USC Computer Science Technical Reports, no. 884 (2006)

(USC DC Other)

USC Computer Science Technical Reports, no. 884 (2006)

PDF

Download

Open document

Flip pages

Download a page range

Download transcript

Copy asset link

Request this asset

Transcript (if available)

Content 1
Analyzing the Interactions of Self-Propagating
Codes in Multi-hop Networks
Abstract—“War of the worms” is a war between
opposing computer worms, creating complex worm
interactions. For example, in September 2003 the
Welchia worms were launched to terminate the Blaster
worms and patch the vulnerable hosts. In this paper, we
try to answer the following questions: How can we
explain the dynamic of such phenomena with a simple
mathematical model? How can one worm win this war?
How do other factors such as locality preference,
bandwidth, worm replication size and reaction time
affect the number of infected hosts? We propose a new
Worm Interaction Model (based upon and extending
beyond the epidemic model) focusing on random-scan
worm interactions. We also propose a new set of
metrics to quantify effectiveness of one worm
terminating other worm. We validate our worm
interaction model using extensive ns-2 simulations.
This study provides the first work to characterize and
investigate multiple worm interactions of random-scan
worms in multi-hop networks. With less than 7% errors,
our model shows very accurate approximation of
simulated infected hosts for all types of interactions.
Furthermore, our estimations in worm interaction
model are only off by 4% for simulated total infected
hosts and 9% for the simulated infectious period when
varying reaction times. The main finding of this study is
that maximum number of infectives can be drastically
affected by the type of interaction.
I. INTRODUCTION
Since the Morris worm incident in 1988, worms
have been a major threat to Internet users. In addition,
more and more worms carry destructive payload
enabling them to perform denial-of-service attacks,
steal username/password or hijack victims’ files.
Worms can be categorized as network worms and email
worms. Network worms such as Slammer, Witty, and
Code Red aggressively scan and infect vulnerable
machines. Mass-mailing worms’ propagation such as
Kamasutra, Love Bugs, and NetSky rely on social
engineering techniques. Several worm propagation
models have been proposed [3, 8] but those worm
propagation models have not considered the interaction
among different worm types, and, as we shall show, are
inadequate to model war of the worms.
The war of the worms creates unprecedented
dynamic and complex scenarios (fig.1) as well as
detrimental impact on infrastructure. In August 2003, a
network worm Welchia attempted to terminate another
network worm Blaster by deleting Blaster’s process and
downloading patch from Microsoft website. Even with
good intention, Welchia created large amount of traffic
causing severe congestion to the Internet and Microsoft
website. Because of its aggressiveness, in this paper we
focus only on interaction of random-scan network
worms that can carry patch within their payload.
Dec May Oct Mar Aug Jan Jun
0
2000
4000
6000
8000
10000
12000
14000
Time
Infectives
Blaster.A
Welchia.A

Figure1 Two-year infected hosts of famous interacting
worms: Welchia.A and Bagle.A

We define above scenario as worm interaction in
which a worm terminates and/or patches another worm.
We focus our study on modeling the interactions of
random scan worms in different network environments
using different scanning strategies. We further
investigate whether non-malicious worms generated by
automatic reverse-engineering techniques [2] or
automatic patching [9] can be used to terminate
malicious worm effectively. However, we find that
such effectiveness does not only depend on scan rate of
worms but also on interaction types, network topologies
and their strategies.

Our contributions in this paper are

• We build a new comprehensive, accurate Worm
Interaction Model. We validate our model through
extensive simulations. We also propose the
network-delay factor that is the function of packet
size, link latency, queuing delay and bandwidth.
Our Worm Interaction Model can be easily
extended to cover complex multiple worm
interactions.
Sapon Tanachaiwiwat and Ahmed Helmy
Department of Electrical Engineering
University of Southern California, CA, 90089
{tanachai, helmy}@usc.edu

2
• We propose a new set of metrics to measure the
effectiveness of one worm terminating another
worm: total infectives (for brevity, we shall call
infected hosts as “infectives” from now on) and
individual life span of terminated worm. We show
the relationships of such metrics to the worm
interaction. Our model can accurately approximate
these metrics with properly chosen network-delay
factors.
• We derive the important parameter,
Epidemiological Threshold, from worm’s scan rate
ratio and initial infective ratio to quantify the
degree of outbreak and guideline for effective worm
containment.
We aim at using our proposed worm interaction
model as the foundation of effective security response
protocol design that deploys beneficial worms to
terminate malicious worms.
Next we discuss the related work in Section II. We
explain the basic epidemic model and related variables
in Section III and then in Section IV we explain the
basic definitions required for understanding the Worm
Interaction Model. After that in Section V, we extend
the basic epidemic model to build the Worm Interaction
Model for (i) one-sided interaction and (ii) two-sided
interaction. In Section VI, we evaluate accuracy of our
model as well as the effectiveness of worm termination
based on proposed metrics. We conclude our work in
Section VII.

II. RELATED WORK

In [2], the authors pointed out that traditional
human intervened responses were too slow and the
worm-terminating-worm scheme may be practical,
since today’s defense (prevention, treatment, and
containment) technology still cannot cope with such
spreading speed [5, 7]. Moore et al. [5] evaluate the
effectiveness of automated network-level worm
containment based on blacklisting and filtering
techniques. Our work aims to provide framework that
can explain worm interactions relating to automated
worm generation to counter on-going attacking worm.
In [2], the authors suggested modifying existing
worms such as Code Red, Slammer and Blaster to
terminate the original worm types. The modified code
will retain portion of attacking method so it would
choose and attack the same set of susceptible hosts. In
this paper, we assume the existence of this technology.
Other active defense such as automatic patching is also
investigated in [9], their work assumes the patch server
and overlay network architecture. Their patch
distribution can be considered as two-sided interaction
in our Worm Interaction Model. We provide the
comprehensive model that can explain the behavior of
automatic-generated beneficial worm and automatic
patch distribution using one-sided interaction and two-
sided interaction accordingly. However, our work limits
only to understanding and evaluating both approaches
but we do not touch upon details of vulnerabilities nor
related software engineering techniques to generate the
patch or worm.
The study in [4, 11] investigated the propagation of
the random scan network worm and local scan
preference strategy which were used by Code Red II
and Nimda. Extending beyond that study, our work
emphasizes the effect of preferred-local-scanning
strategy as well as underlying network characteristics
such as reaction time, worm replication size, bandwidth
on worm interactions.

III. EPIDEMIC MODEL

From [2], the basic susceptible-infected-recovered
(SIR) epidemic model which was developed for the
study of biological infectious diseases has been used to
explain the behavior of self-replicating network worms.
In SIR model, vulnerable hosts fall in one of
following states in sequence—susceptible, infected and
recovered. Susceptible hosts have never had the disease
and can catch it. Infected hosts have the disease and are
contagious. Recovered hosts have already had the
disease and are immune or cured.
Let N be the size of vulnerable population, I be the
number of infected hosts at time t, R be the recovered
hosts at time t, β be contact rate i.e. the rate of contact
between hosts, γ be the removal or recovered rate and
S which equals to R I N − − be the number of susceptible
hosts at time t. β and γ are assumed constant.
The fundamental nonlinear ordinary differential
equations of SIR model are shown below,

SI
dt
dS
β − = (1)
I SI
dt
dI
γ β − = (2)
I
dt
dR
γ = . (3)

The transitions of states are shown in fig.2. An
arrow represents a flow from one state to another. This
model does not consider the birth/death of population as
well as the spatial distribution of susceptible hosts.
SI β I γ

Figure 2 SIR Epidemic Models

From (2), the epidemic is sustainable only if
0
dt
dI
> which requires 1
S
>
γ
β
; such important ratio is
called Epidemiological Threshold,
3

γ
βS
E
0
≡ . (4)

We would use SIR model as the foundation of our
proposed Worm Interaction Model which we will
discuss in Section V.
IV. DEFINITIONS
In previous section, we have discussed general
definitions of SIR model. However we need additional
elementary definitions and concepts that we use in
Worm Interaction Model. We start by examining the
important concept of the predator-prey relationships.
A. Predator-Prey Relationships
For every worm interaction types, there are two
basic characters:
Predator: A worm that terminates or patches
another worm.
Prey: A worm that is terminated or patched by
another worm.
A predator can also be a prey at the same time for
some other type of worm. Predator can vaccinate a
susceptible host i.e. infect the susceptible host and
apply patch afterward to prevent the hosts from prey
infection. Manual vaccination, however, is performed
by a user or an administrator by applying patch to a
susceptible host.
A termination means a removal of prey from
infected hosts by predator; and such action causes prey
infectives become predator infectives. The removal by a
user or an administrator is referred as a manual
removal. After being manual removed and vaccinated,
the host will not be infected by neither prey nor
predator.
We choose to use two generic types of interacting
worms, A

and B, as our basis throughout the paper. A

and B

can assume the role of predator or prey
depending on the type of interactions.

B. Worm Life-cycle
Fig.3 illustrates the basic life cycle of predator and
prey. Predator and prey search for susceptible hosts by
using either TCP (such as Code Red and Code Red II)
or UDP exhaustive scan (such as Slammer and Witty).
Unlike UDP-scan worm, TCP-scan worms need to wait
for its responses from valid destinations. The waiting
time makes its scan rate much slower than the scan rate
of UDP-scan worms.
Only predator (fig.3(a)) needs to check whether
prey resides in the same host before it can terminate
prey (fig.3(b)) and patch the host to prevent reinfection
from prey (if patch available). Both types terminate
itself after predefined timeout unless it has been
terminated by opposing worm or manual removal
process. For example, Welchia has embedded timeout
which it will disable and terminate itself if the year
from computer system’s date is 2004 [6]. The reason
for self-termination is for reducing unnecessary
workload and traffic on the host infected by Welchia.

(a)

(b)

Figure 3 Life cycles of (a) Predator (b) Prey

C. Contact rate
As explained in subsection IV.B, each worm
constantly scans the vulnerable hosts by issuing new
worm replication to randomly chosen address. Let
v
P
be the probability of worm replication having a contact
with a vulnerable host from the total address space υ
i.e. for IPv4 is 2
32
. We define a contact as a worm
replication reaching a destined vulnerable host.
Let
s
P be the fraction of a vulnerable host reached by a
worm replication,

υ
N
P
v
≡ (5)

N
1
P
s
≡ (6)

where 1 P 0
v
≤ ≤ and 1 P 0
s
≤ ≤ .
4
A worm replication can be significantly slowed
down by network delay (L) including transmission
delay, link delay, processing delay and queuing delay.
Let
A
ρ and
B
ρ be the network-delay factor to attenuate
contact rate of A and contact rate of B.
Let
A
υ and
B
υ be scanned address space of A and
scanned address space of B,
A
r and
B
r be the scan rate
of A and scan rate of B where a scan rate is a frequency
of a worm issuing its replication to chosen destinations.
Thus

s v A A A
P P r ρ β ≡
A
A A
r
υ
ρ
= (7-a)
s v B B B
P P r ρ β ≡
B
B B
r
υ
ρ
= (7-b)
where 1 , 0
B A
≤ ≤ ρ ρ .
Let
A
L and
B
L be network delay for A and B
accordingly. We can derive
A
ρ and
B
ρ as follows.
A
A
L 1/r
1/r
A
A
+
= ρ (7-c)
B
B
L 1/r
1/r
B
B
+
= ρ (7-d)

D. Worm Interaction Ratios
To estimate how much relative characteristics of
predator and prey impact on their propagations, we
propose following worm interaction ratios: scan rate
ratio, initial infective ratio. We further develop the
concept of similarity and difference to gain the insight
from relationships between scan rate ratios, and
between initial infective ratios. We also systemically
derive minimum scan rate ratio and minimum initial
infective ratio for effective termination in Section V.

a. Scan rate ratio

Scan rate ratio is the ratio of scan rates of one worm
type to that of another worm type. Let X be a scan rate
ratio of B to A,

A
B
r
r
X ≡ (8)
If we assume that
B A
ρ ρ = then contact rate ratio of A
and B can be derived as

A
B
β
β
X
r
r
A
B
= = . (9)
X i is similar to X j only when
j
j
i
i
A
B
A
B
r
r
r
r
= , otherwise
different where i and j represent interaction pairs.
For example, X 1 = 1:2 is similar to X 2 = 2:4 but the
first ratio has
A
r =1/sec,
B
r = 2/sec and the latter has
A
r =2/sec,
B
r = 4/sec. To differentiate between this X 1
and X 2, we use scan-rate-ratio multiplicative factor k i,
from above example we have k 1=1.0 for X 1 and k 2=2.0
for X 2. We use X= 1:1 as the absolute reference. The
importance of this concept is shown in Section V.

b. Initial Infective ratio
Initial infected host ratio is the ratio of infective of
one worm type to another worm type at initial release
time of both worms. Let Y be an initial infective B to
A,

) 0 ( A
) 0 ( B
I
I
Y ≡ (10)

where ) 0 ( I
A
and ) 0 ( I
B
= number of initial infectives of A

and B respectively at their released times.
This ratio is only valid when there is no difference
in launching time of A

and B
.
We can also consider the
ratio of infected hosts for any t; however, we shall
consider the delay of launching the opposing worm
(reaction time) in the next subsection.
Again Y i is similar to Y j only
when
j
j
i
i
) 0 ( A
) 0 ( B
) 0 ( A
) 0 ( B
I
I
I
I
=
j
j
i
i
A
B
A
B
r
r
r
r
= , otherwise different.
For example Y 1= 1:1 is similar to Y 2= 2:2 but the first
ratio has
) 0 ( A
I = 1,
) 0 ( B
I =1 and the latter has
) 0 ( A
I = 2,
) 0 ( B
I =2. To differentiate between this Y 1 and Y 2, we use
initial-host-ratio multiplicative factor l i which l 1=1.0 for
Y 1 and l 2=2.0 for Y 2. We use Y=1:1 as the absolute
reference. The importance of this concept is shown in
Section V.

V. WORM INTERACTION MODEL

We aim to build a fundamental worm propagation
model that captures worm interaction as a key factor.
Furthermore, our proposed model should determine
what happen to susceptible hosts, prey and predator
over the course of time.
In our model, number of infectives of one worm
type affects number of infectives of others. Because the
constant removal rate in basic SIR model [3] cannot
directly portray such interactions, our model builds
upon and extends beyond the conventional epidemic
model to accommodate the notion of interaction. Our
model assumes no change of total host population.
As discussed in subsection IV.B, basic operation of
a worm is to find susceptible nodes to infect and the
main goal of attackers is to have their worms infect the
largest amount of hosts in the least amount of time, and
if possible, remain undetected by antivirus or intrusion
detection systems; however, recently the goal of
attackers, has been expanded to eliminate opposing
worms. Thus we want to investigate the worm
5
propagation behavior caused by this and other types of
interactions.
Worm interaction can be categorized as one-sided
or two-sided interaction. One-sided interaction means
one worm type terminating and/or patching other worm
type. Two-sided interaction means two worm types
terminating and/or patching each other. To describe
these interactions, we develop a novel Worm
Interaction Model extending the epidemic model [3].
Α Α Α Α. . . . One-sided interaction (Prey/Predator Model)

When there is a prey, A, and a predator, B, we
consider this as one-sided interaction. For ideal
scenario, predator wants to terminate prey as much as
possible as well as prevent prey from infection and
reinfection. To satisfy that requirement, predator
requires patch or false signature of prey. Details of
worm interaction that does not incorporate patch or
false signature, including friendly interaction, can be
found in [8].

A A
SI β
B A B
I I β
B B
SI β
B B
I γ
A A
I γ
S
S
γ

Figure 4 Aggressive one-sided interactions
0 5 10 15
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
Time
Infective Fraction (A)
X=2:3
X=3:3
X=4:3
X=5:3
X=6:3
0 5 10 15
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
Time
Infective Fraction (A)
X=1:1
X=2:2
X=3:3
X=4:4
X=5:5

(a) (b)
0 5 10 15
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
Time
Infective Fraction (A)
Y=2:3
Y=3:3
Y=4:3
Y=5:3
Y=6:3
0 5 10 15
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
Time
Infectiv e Fraction (A )
Y=1:1
Y=2:2
Y=3:3
Y=4:4
Y=5:5

(c) (d)
Fig. 5 Prey infectives of aggressive one-sided interaction with (a)
different scan rate ratio (b) similar scan rate ratio (Y= 1:1 for
(a) and (b)) (c) different initial infective ratio (d) similar initial
host ratio (X= 1:1 for (c) and (d))
There are two types of interactions considered in
one-sided interaction: aggressive and conservative.
Aggressive predator terminates prey and vaccinates
susceptible hosts while conservative predator only
terminates prey but will not vaccinate (or infect)
susceptible hosts.

a. Aggressive one-sided interaction

Interaction between Welchia and Blaster can be
represented by this model. As shown in fig.4,
susceptible hosts’ decrease rate is determined by
manual vaccination and the contact of susceptible hosts
with prey causing prey infection or with predator
causing predator vaccination. Hence, the susceptible
rate is

S SI SI
dt
dS
S B B A A
γ β β − − − = . (11)

Since prey relies on susceptible hosts to expand its
population, the increase of prey infection rate is
determined by the contacts of the susceptible hosts and
prey infectives. The decrease of prey infection rate is
determined by manual removal and prey termination
caused by the contacts of prey infectives and predator
infectives whose contacts are initiated by the predator.
Hence the prey infection rate is

A A B A B A A
A
I I I SI
dt
dI
γ β β − − = . (12)

Because predator can terminate prey host as well as
vaccinate susceptible hosts, the increase of predator
infection rate is determined by the contacts of predator
hosts with either the susceptible hosts or prey infectives
whose contacts are initiated by predator. The decrease
of predator infection is, however, determined only by
manual removal. We have not considered timeout in the
model since the timeout should occur only after long
period of time. Thus

B B B A B B B
B
I I I SI
dt
dI
γ β β − + = . (13)

The removal rate is simply the sum of vaccination of
susceptible hosts, manual removal of both prey and
predator.

B B A A S
I I S
t
dR
γ γ γ + + = . (14)
From (12), the epidemiological threshold for prey is

A B B
A
A A B A B
A A
A
I
S
I I I
SI
E
γ β
β
γ β
β
+
=
+
=
. (15)
6

If we want prey to be contained by predator i.e.
A
E < 1 at t=0, we assume no manual removal process at
very beginning of propagation because of user’s
unawareness of worm presence, hence =
A
γ =
B
γ 0
and
A
β ,
B
β , ) 0 ( I
A
, > ) 0 ( I
B
0, we requires that the
minimum scan rate ratio to be

X
A
B
=
β
β
) 0 ( YI
) 0 ( S
) 0 ( I
) 0 ( S
A B
= > (16)

or minimum infective ratio to be

Y
) 0 ( XI
) 0 ( S
A
> . (17)

From (13), the epidemiological threshold for
predator is

B
A B
B B
B A B B B
B
) I S (
I
I I SI
E
γ
β
γ
β β +
=
+
=
. (18)

With the same assumption, predator can always
spread with =
B
γ 0 ( =
B
E ∞).
To see the importance of scan rate ratio and initial
host ratio, we plot numerical solutions from our
aggressive one-sided interaction model using four sets
of variables in this model: (1) similar scan rate ratios
with a fixed initial host ratio (fig. 5(b)), (2) similar
initial host ratios with a fixed scan rate ratio (fig. 5(d)),
(3) different scan rate ratios with a fixed initial host
ratio (fig.5(a)), and (4) different initial host ratios with a
fixed scan rate ratio (fig.5(c)).
We find that, in fig.5 (a) and (c) prey infectives are
reduced more with the increase of X
i
than that of
increase of Y
i
. This implies that change of X
i
has much
more impact on the level of prey infection than the
change of Y
i
does. This can be observed from fig.10
that the change of predator scan rate causes
multiplicative change in prey infection rate while the
change of predator initial infected host ratio only causes
additive changes in prey infection rate.
Other important finding here in fig.5 (b) is that
similar scan rate ratios with different k
i
in fixed
population yields equal maximum of prey infectives;
however, times that take to reach the exact number of
infectives between similar scan rate ratios decrease
proportionally with the increase of k
i
. To be specific,
we shall explain an example from fig.5 (b) where X
1
=
1:1, X
2
= 2:2, …, X
5
= 5:5. We can observe that the time
required to reach maximum of prey infective for X
1
is
1.3185 seconds which is 0.2 (or k
1
/ k
5
) of time required
to reach maximum of A infective for X
5
which is
6.5927 seconds. This observation is also applied to any
other X
i
. This also hints us that automated generating
worm that preserve the characteristic of original worm
will optimally limit the maximum prey infectives to
20% of vulnerable populations no matter what original
scan rate is.
Furthermore, this observation also applies to sets of
similar initial infective ratio for equal maximum of prey
infectives as shown in fig.9 (d). However, in this figure,
we keep the ratio of susceptible hosts to initial predator
infectives to initial prey infectives similar, e.g. Y
1
=1:1
with S
1
=998, Y
2
=2:2 with S
2
=1996,…, Y
5
=5:5 with
S
5
=4990. We can observe that all infective fractions of
prey for different l i overlapping exactly at the same
positions for all t. This means that the number of total
vulnerable hosts does not affect the relative fraction of
infections as long as the ratio of susceptible hosts to
predator infectives to prey infectives are similar.
A A
SI β B A B
I I β
B B
I γ
A A
I γ
S
S
γ

Figure 6 Conservative one-sided interactions
0 5 10 15
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1.0
Time
In fe ctive s Fra ctio n (A )
X=2:3
X=3:3
X=4:3
X=5:3
X=6:3
0 5 10 15
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
Time
In fe ctive Fra c tio n (A )
X=1:1
X=2:2
X=3:3
X=4:4
X=5:5

(a) (b)
0 5 10 15
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
Time
In fe ctive s F ra ctio n (A )
Y=2:3
Y=3:3
Y=4:3
Y=5:3
Y=6:3
0 5 10 15
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
Time
In fe c tiv e F ra c tio n (A )
Y=1:1
Y=2:2
Y=3:3
Y=4:4
Y=5:5

(c) (d)
Fig. 7 Prey infectives of conservative one-sided interaction with
(a) different scan rate ratio (b) similar scan rate ratios (initial
infective ratio is 1:1) (c) with different initial infective ratios (d)
similar initial host ratios (scan rate ratio is 1:1)

b. Conservative one-sided interaction

In conservative interaction, the predator, B, is
trying to reduce unnecessary infections by avoiding
infection of susceptible hosts. In other words, predator
does not vaccinate (or infect) any susceptible host, but
will terminate any found prey, A, on the chosen
vulnerable host. Hence the predator infectives change
depends solely on population of the prey infectives.
7
We show the state transition of conservative one-
sided interactions in fig.6. The susceptible hosts are
now only converted to prey but not to predator. Hence,
the decrease of susceptible hosts in this model is
determined by the manual vaccination and prey
infection caused by the contact between susceptible
hosts and the prey. Hence

S SI
dt
dS
S A A
γ β − − = . (19)

Since the prey behavior is the same as of aggressive
one-sided interaction, the prey infection rate can be
derived similarly which

A A B A B A A
A
I I I SI
dt
dI
γ β β − − = . (20)

As mentioned earlier, predator infectives growth
rate depends only on prey termination. Still, the
decrease of predator infection rate is due to manual
removal. Thus, predator infection rate is

B B B A B
B
I I I
dt
dI
γ β − = . (21)

The removal rate is again the sum of vaccinated
susceptible hosts, and manual removal of prey and
predator, hence the removal rate is

B B A A S
I I S
t
dR
γ γ γ + + = . (22)

From (20), the epidemiological threshold for prey is
A B B
A
A A B A B
A A
A
I
S
I I I
SI
E
γ β
β
γ β
β
+
=
+
=
. (23)

Hence if we want to contain prey at t=0 i.e.
A
E < 1,
assume =
A
γ =
B
γ 0 and
A
β ,
B
β , ) 0 ( I
A
, > ) 0 ( I
B
0. We
requires that minimum scan rate ratio to be

X
A
B
=
β
β
) 0 ( YI
) 0 ( S
) 0 ( I
) 0 ( S
A B
= > (24)

or minimum infective ratio to be

Y
) 0 ( XI
) 0 ( S
A
> (25)

which are surprisingly the same conditions for scan rate
ratio and initial infective ratio as of aggressive
interaction. However, at t > 0, prey epidemiological
threshold of aggressive one-sided interaction drops with
much greater rate than that of conservative one-sided
interaction.
From (21), the epidemiological threshold for
predator is
B
B B
A B
B A B
B
I
I
I I
E
γ
β
γ
β
= =
. (26)

With the same assumption above and
B
E > 1, then
predator only need susceptible hosts and initial prey
infectives to be greater than 0.
In early phase of conservative one-sided
interaction, we can expect lower infection rate of
predator in this model than that of aggressive one-sided
interaction. The increase of predator infection in this
model depends solely on prey infectives which much
smaller than the sum of susceptible hosts and predator
infectives that used in aggressive one-sided interaction.
Furthermore, this condition causes initial higher prey
outbreak as well as prey infectives being slower to be
completely terminated than that of aggressive one-sided
interaction. This results in much higher of maximum
prey infection than that of aggressive one-sided
interaction.
The observation from fig.7 still indicates the
dominance of scan rate ratio over initial infective ratio
on conservation one-sided interaction. Furthermore, the
relationships of similar scan rate ratios with varied k
i

and relationships of similar initial infective ratios with
varied l
i
of this model share the same characteristics
with those in aggressive one-sided interaction. However
the effects of those relationships on prey infectives are
much weaker than those of aggressive one-sided
interaction. In this model, if automated worm
generation produces the same worm characteristics, it
would optimally limit the prey maximum infectives to
95% of population which is much worse than that of
aggressive one-sided interaction which is 20% of
population. The differences between the maximum
infectives of aggressive one-sided and conservative
one-sided interaction are shown in fig.10.
A A
SI β
B B
SI β
B B
I γ
A A
I γ
S
S
γ

Figure.8 Two-sided Interaction
B. Two-sided interaction (Predator/Predator Model)

This two-sided interaction model is extended from
aggressive one-sided interaction model explained in
earlier section. In this model, both worms assume the
roles of predator and prey simultaneously. We would
simply call A as predator A and B as predator B. The
automated patching assuming each worm patches its
8
own host to prevent infection from the other worm is
closely related to this model.
We show the state transition of this model in fig.8.
Similar to aggressive one-sided interaction, the change
of susceptible hosts is caused by prey infection and
predator infection. Hence the susceptible rate for this
model is

S SI SI
dt
dS
S B B A A
γ β β − − − = . (27)

Because predator A cannot terminate predator B
and vice versa, the predator A infection rate is only
determined by the predator A infection caused by the
contacts between the susceptible hosts and the predator
A. The decrease of predator infection rate is, however,
due to manual removal. Since this is two-sided
interaction, the predator B infection rate can be derived
similarly to infection rate of predator A.

A A A A
A
I SI
dt
dI
γ β − = . (28)
B B B B
B
I SI
dt
dI
γ β − = . (29)

The removal rate is, again, similar to one-sided
interaction,
B B A A S
I I S
t
dR
γ γ γ + + = . (30)

From (28) and (29), the epidemiological thresholds
for predator A and predator B are

A
A
A A
A A
A
S
I
SI
E
γ
β
γ
β
= = (31)
B
B
B B
B B
B
S
I
SI
E
γ
β
γ
β
= = . (32)

According to the assumption of removal rate,
assume =
A
γ =
B
γ 0, and
A
β ,
B
β , ) 0 ( I
A
, > ) 0 ( I
B
0, we know
that
A
E and
B
E will be always greater than 0.
Hence, unlike one-sided interaction, we can
observe that predator A will not be completely
terminated but only to be contained. To be more
specific, from fig.9(a) that if we want to contain
predator A to be lower than 10% then we need scan
rate ratio at least similar to X=5:3.
Unfortunately, as shown in fig.9 (c), predator B can
barely contain predator A with any chosen Y. The
similar scan rate ratios (fig.9 (b)) and similar initial
infective ratios (fig.9 (d)) also show the same maximum
infectives as in one-sided interactions. The relationships
of similar scan rate ratio with varied k
i
and similar
initial infective ratios with varied l
i
are still the same as
those of one-sided interaction.
0 5 10 15 20
0
0.2
0.4
0.6
0.8
1
Time
Infective F raction (A)
X=2:3
X=3:3
X=4:3
X=5:3
X=6:3
0 5 10 15
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
Time
Infe ctive Fra ction (A)
X=1:1
X=2:2
X=3:3
X=4:4
X=5:5

(a) (b)
0 5 10 15
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
Time
Infective Fraction (A )
Y=2:3
Y=3:3
Y=4:3
Y=5:3
Y=6:3
0 5 10 15
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
Time
Infec tiv e F rac tion (A )
Y=1:1
Y=2:2
Y=3:3
Y=4:4
Y=5:5

(c) (d)
Fig. 9 Prey infectives of two-sided interaction with (a) different
scan rate ratio (b) similar scan rate ratios (Y = 1:1 for (a) and
(b)) (c) with different initial infective ratios (d) similar initial
host ratios (X= 1:1 for (c) and (d))

We can further observe with similar scan rate
ratios, and initial infective ratios, based on maximum
infectives as seen in fig.10, aggressive one-sided
interaction has lowest maximum infectives when
compared with two-sided interaction and conservative
one-sided interaction. We can conclude that different
types of interactions yield significant different number
of maximum infectives even with similar scan rate ratio
or similar initial infectives ratio.
0.00
0.10
0.20
0.30
0.40
0.50
0.60
0.70
0.80
0.90
1.00
0.50 1.00 1.50 2.00 2.50 3.00
Ratio
Maximum infectives (Fraction)
1-sided aggressive (X)
1-sided aggressive (Y)
1-sided conservative (X)
1-sided conservative (Y)
2-sided (X)
2-sided (Y)

Fig. 10 Relationships of maximum infectives with scan rate ratio
and initial infective ratio for all types of interaction
VI. SIMULATION RESULTS

To validate our Worm Interaction Model, we
investigate network worm propagation using ns-2
simulation [12].
Our goal is to verify the accuracy of our
mathematical model and have better understanding of
worm interaction in a rich set of environments. We
choose the Slammer-like worm characteristic as basic
behavior of a worm in this simulation. Slammer is
9
chosen because, despite its simplicity, it still holds the
world record of fastest-spread worm yet.
We simulate two types of worms: A and B which
may have different scan rates and initial infectives.
Even we consider the manual removal earlier in the
model; we do not model human interaction because we
only want to focus on worm interaction.
We simulate 1000 vulnerable hosts in following
topologies:
1. Star-shaped topology: we want to test our model
with network having small number of hops (1-2 hops)
that has moderate constant bandwidth (512 kbps) and
constant delay (1ms) between hosts.
2. Transit-stub topology: this two-level topology will
help us test our model with bottleneck network having
large number of hops (1-4 hops) that has moderate
bandwidth (512 kbps access-link, 10 Mbps local
network) and delay between hosts (average 1 ms).
There are 10 local networks; each local network has
100 hosts with one of them acting as a router. One AS
can have one or two local networks. The links between
routers in this topology are generated by BRITE
Internet topology generator [1].
Each worm use UDP scan to transfer worm
replication to random chosen vulnerable hosts of the
network. The default packet size is 404 bytes which
similar to Slammer worms.

A. Model Accuracy

In this section, we compare the simulation results
with our proposed model. We use the X = 2:2 for every
model evaluation. We assume
v
P =1.0 for A and B (the
vulnerable host address range is exactly the same as
scan address range). This assumption make the worm
propagate much faster than the real worm propagation.
We will investigate the scenario that
v
P is much less
than 1.0 in subsection VI.C.
Fig.10 show that our numerical solution of our
aggressive one-sided interaction mathematical model
with
A
ρ =0.65 and
B
ρ =0.65 closely match with
simulation results, especially to the results of worm
interaction in transit stub topology. Although, from our
simulation, using equation 7(c) and 7(d), our estimation
for
A
ρ and
A
ρ of transit stub topology around 0.64
based on
A
L and
B
L = 0.284 second derived from 90%
of scanning traffics go outside the local network and
average queue size is 49 for outbound link.
Hence, this figure suggests that different topologies
can yield different interaction characteristics. The
reason that simulated propagation in transit stub
topology is slower than that of star topology (estimate
from simulation,
A
ρ =0.98 and
B
ρ =0.98
A
L and
B
L =
0.0084 second) because of higher average number of
packets in queues and higher average number of hops;
even local network bandwidth in the transit stub
topology is much higher than bandwidth of star
topology but, based on address range, local network
traffic only accounts for 10% of all traffic. When
compared with simulation results in the Transit-stub
topology, our model estimation for prey infectives are
almost perfect for aggressive one-sided interaction,
only off by 7% for conservative ones-sided interaction
and off by 3% for two-sided interaction.
To see the advantage of choosing local network
preference effectively, we will investigate the effect of
local network preference on worm interaction in
subsection VI.C.
We can see that with similar X and similar Y, B in
aggressive one-sided interaction can limit A better than
B in the other two types of interactions. This
observation is agreed with previous observation in
Section V.

0 5 10 15 20
0
0.2
0.4
0.6
0.8
1
Time
Infectives Fraction
Model A
Model B
Star A
Star B
Trans A
Trans B
0 5 10 15 20
0
0.2
0.4
0.6
0.8
1
Time
Infectives Fraction
Model A
Model B
Star A
Star B
Trans A
Trans B

(a) (b)
0 5 10 15 20
0
0.2
0.4
0.6
0.8
1
Time
Infectives Fraction
Model A
Model B
Star A
Star B
Trans A
Trans B

(c)
Figure 11 Comparison between mathematical model and
simulation results from ns-2 star topology (a) aggressive one-
sided interaction (b) conservative one-sided interaction (c) two-
sided interaction.

B. Effectiveness of Termination

Because we see that B is most effective in
terminating A in the aggressive one-sided interaction,
we choose to focus more on this type of interaction.
The effectiveness of termination is defined as a
measure of how efficient predator can terminate prey in
aggressive one-sided interaction. In other words, how
much damage does prey causes to the network after
predator is launched to terminate prey.
We quantify such effectiveness as two important
characteristics of prey:

Total infectives (T): the number of prey infectives
including infectives that have been removed. Total
infectives of prey can be derived from
∫
∞
=
=
0 t
A A
dt SI T β . (33)
10
We have mentioned maximum infectives
earlier but T is the real damage while the
maximum infectives is only the maximum of
instantaneous number of prey infectives at that
time.
Individual life span (L): the time between the start
of infection and the end of infection i.e. infectious
period for individual replication of prey caused by
prey termination. Individual life span is derived
from weighted average of
t B
)) I
B
(1/(β that weigh on
number of terminated node
t
W by predator at that
time instant
T
)) I ( W
L
t
t B t
∑
=
B
1/( * β
(34)
where
A B B B t
I ) I I ( W Δ β Δ − =
From (13), we can derive the life span (or
infectious period) at time t of each prey from the
inverse of product of predator contact rate and predator
infectives at time t, i.e.
t B
)) I
B
(1/(β . The sum of product
of that term and number of terminated prey gives the
total life span for all prey infectives, and hence we
divide the that term by total infectives to get average
individual life span. We will investigate the effect of
deployment scenarios on these metrics as well as verify
the accuracy of the model with metrics observed from
the simulation next.

C. Deployment Scenarios

We simulate the aggressive one-sided worm
interaction in different deployment scenarios which we
shall discuss next. We deploy two worms in transit-stub
topology as shown earlier. In addition, now we have 3
outbound bandwidths for the same transit-stub
topology: 512 kbps, 1 Mbps and 2 Mbps.
In subsection V.A we have shown that our model
shows good approximation if we can estimate network-
delay factor properly. Furthermore, we find that we can
have lowest infection level from best-case scenario
from aggressive one-sided interaction. We still assume
v
P =1.0 for prey and predator.
Here, we focus on the imperfection caused by
deployment scenarios that affect the aggressive one-
sided interaction. Effect of following factors on our
proposed metrics T and L are investigated.

a. Reaction time

The reaction time is the time required before
launching the predator by automated worm generation
or programmer. Automated worm [2] or patch
generation [9] should take much less time compared to
manual process. Our model assumes that predatot starts
scanning immediately at the time of infection and hence
the delay of patch applying will not be considered in
our model. Furthermore, we also assume that patch
takes effect instantly without need of rebooting the
machine.
As shown in fig. 12 (a), prey individual life span
grows exponentially with reaction time. However, the
reaction time causes significant increase of total
infections only in low reaction time range. The lower
outbound bandwidth causes much higher individual life
span but almost no differences for total infectives.
This occurs because the lower outbound bandwidth
causes equally drops in contact rate of prey and
predator. Hence the slow down of worm interaction
causes prey to survive longer. However, according to
observation in fig.12 (b), we know that three outbound
bandwidth links are going to have the same maximum
infective implying equal of total prey infectives.
Furthermore because the total infectives is the non-
decreasing function of time, for slower reaction time,
such product is only going higher; the total infectives
cannot grow beyond the number of susceptible hosts
and hence, it causes the gradually drop in the growth
rate of total infectives and finally saturate at level of
population size.
From the model with reaction time = 0, using
A
ρ =0.65 and
B
ρ =0.65, our estimations in worm
interaction model are only off by 4% for simulated total
infected hosts and 9% for the simulated infectious
period when varying reaction times. We can observe
that our model has better approximation for total
infections in the slow reaction time range. We expect
the closer estimation if we consider dropping of contact
rate modeling caused by congested outbound link [10].

0
1
2
3
4
5
6
0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 5
Reaction Time (Sec)
Individual Life Span
Individual Life Span 2 Mbps
Individual Life Span 1 Mbps
Individual Life Span 512 Kbps
Model

(a)
300
400
500
600
700
800
900
1000
0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 5
Reaction Time (Sec)
Total Infectives
Total Infectives 2 Mbps
Total Infectives 1 Mbps
Total Infectives 512 Kbps
Model

(b)
Figure 12 Effect of reaction time on (a) prey individual life
span and (b) total infectives

11
b. Worm replication size

This factor is a transmission overhead reflecting the
efficiency of coding and compression technique that
automatic generation or programmer uses. Some
examples of worm replication sizes and compression
mechanisms can be found [6].
The increase of worm replication size in fig. 13 (a)
causes the linear increase of prey’s individual life span;
the effect is clearly seen in highly congested access-
linked networks i.e. 512 kbps link. Surprisingly the
increase of replication size almost has no impact on
total infectives (fig. 13(b)) even in the highly congested
access-linked networks. That suggests the delay caused
by any size of packet equally slow down on both prey
replication and predator replication.
From the model, if patch size is 1212 bytes in
512kbps access link, with
A
ρ =0.6 and
B
ρ =0.575, our
estimations in worm interaction model are only off by
8% for simulated total infected hosts and 9% for the
simulated infectious period when varying worm
replication size. According to simulation results, our
model predicts total infectives more accurately than
predicts individual life span.

c. Local preference.

By focusing on scanning the hosts in the same
subnet addresses, worm can avoid scanning invalid
addresses and reducing the packet drops caused by
bottleneck of outbound access of local network to the
Internet. Since majority of addresses in IPv4 are not
fully utilized, appropriate local preference can also be
an important factor. Many network worms already try
to minimize the probability of scanning invalid
addresses by using this technique [6]. In particular, the
local preference has significant impact on
v
P and hence
on
A
β and
B
β . If worm uses different i strategies to scan
vulnerable hosts, we can derive
v
P , the probability of
worm replication having a contact with a vulnerable
host, based on local preference as follows.

i
i
i v
p f P
∑
= (35)

where
i
f is fraction of strategy i being used,
i
p is
the probability of worm replication having a contact
with a vulnerable host address from the chosen address
space
i
υ of strategy i which has
i
n vulnerable hosts in
such address range. For example,
i
υ of worm preferring
vulnerable hosts in the same /16 address has address
size =
16
2 instead of
32
2 , furthermore, if in that
address range, there are vulnerable
14
2 hosts
then
i
p =0.25.
In our simulation, each worm uses 2 strategies and
the valid address only occupies 10% of its scanned
address range. Two strategies are assigned as following:

(1) random-scan ( =
1
p 0.099 with
1
f )
(2) preferred-local-scan ( =
2
p 0.99 with
2
f ).

In Fig.14 (a) and (b), we vary
1
f and
2
f of both
worms to see how that factor affects the interaction
between two worms. Given prey local preference = 0,
we see that predator show significant improvement with
local preference at least 0.3 from fig.14 (a) for
individual life span at least 0.6 for individual life span
from fig.14 (b). With prey local preference = 0.5, the
effectiveness of termination will drop significantly.
Predator can terminate prey effectively according to
individual life span if its local preference is at least 0.6.

1
1.2
1.4
1.6
1.8
2
2.2
2.4
2.6
404 504 604 704 804 904 1004 1104 1204
Worm Replication Size (Bytes)
Individual Life Span (Sec)
Individual Life Span 2 Mbps
Individual Life Span 1 Mbps
Individual Life Span 512 Kbps
Model

(a)
0
100
200
300
400
500
600
700
800
900
1000
404 504 604 704 804 904 1004 1104 1204
Worm Replication Size(Bytes)
Total Infectives
Total Infectives 2 Mbps
Total Infectives 1 Mbps
Total Infectives 512 Kbps
Model

(b)
Figure 13 Effect of worm replication size on (a) prey
individual life span and (b) total infectives

This effect of prey local preference become more
apparent according to total infectives (fig. 14); the
lowest total infective for prey with local preference 0.5
is as high as 0.90 compared to 0.01 for prey with local
preference 0. Hence predator should always utilize the
local preference appropriately since we can assume that
majority of prey exploit local preference scanning as
well. Our estimations in worm interaction model are
only off by 36% for simulated total infected hosts and
33% for the simulated infectious period when varying
local preference.
We can also observe that our mathematical model
has very close approximation of chosen metrics in the
simulation with local preference strategy considered in
worm interaction.

12

0
1
2
3
4
5
6
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1
Predator Local Preference
Prey Individual Life Span
Model X=15:30 f=0
Sim X=15:30 f=0
Model X=15:30 f=0.5
Sim X=15:30 f=0.5

(a)
0
200
400
600
800
1000
1200
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1
Predator Local Preference
Prey Total Infectives
Model X=15:30 f=0
Sim X=15:30 f=0
Model X=15:30 f=0.5
Sim X=15:30 f=0.5

(b)
Figure 14 Effect of local preference with two scan rate ratios on
(a) prey individual life span and (b) on total infectives

VII. SUMMARY AND FUTURE WORK

Based on our worm interaction study, we find that
worm interaction causes drastic change in the worm
propagation model. Such interaction cannot be
explained by earlier works based on the epidemic
model even when the removal process is used. We
identify three types of interactions: aggressive one-
sided interaction, conservative one-sided interaction,
and two-sided interaction that show significantly
different patterns of propagation.
We developed a new worm propagation model
which is validated through extensive simulations. We
find that scan rate ratio has much more impact on worm
propagation pattern than initial infected host ratio for
every type of interaction. With similar scan rate ratios,
for every type of interaction, it always results in the
same maximum prey infectives. While we focus on
aggressive one-sided interaction, our model shows
promising accuracy in estimating individual life span
and total infectives for different scenarios. We shall
further develop the worm interaction model in mobile
networks and evaluate it in a test bed. Worm
interactions in different mobility models will be
explored. More details on our worm interaction models
and simulation results can be found in [8].

REFERENCES

[1] BRITE: Boston Representative Internet Topology
Generator
[2] F. Castaneda, E.C. Sezer, J. Xu, “WORM vs.
WORM: preliminary study of an active counter-attack
mechanism”, ACM workshop on Rapid malcode, 2004
[3] J.C.Frauenthal. Mathematical Modeling in
Epidemiology. Springer-Verlag,New York,1988
[4] A. Ganesh, L. Massoulie and D. Towsley, The
Effect of Network Topology on the Spread of
Epidemics, in IEEE INFOCOM 2005.
[5] D. Moore, C. Shannon, G. M. Voelker, and S.
Savage, "Internet Quarantine: Requirements for
Containing Self Propagating Code", in IEEE
INFOCOM 2003.
[6] Trend Micro Annual Virus Report 2004
http://www.trendmicro.com
[7] N. Weaver, S. Staniford, V. Paxson, Very Fast
Containment of Scanning Worms, 13th USENIX
Security Symposium, Aug 2004
[8] S. Tanachaiwiwat, A. Helmy, "VACCINE: War of
the Worms in Wired and Wireless Networks", Technical
Report CS 05-859, Computer Science Department,
USC
[9] M. Vojnovic and A. J. Ganesh, “On the
Effectiveness of Automatic Patching” , ACM WORM
2005, The 3rd Workshop on Rapid Malcode, George
Mason University, Fairfax, VA, USA, Nov 11, 2005.
[10] N. Weaver, I. Hamadeh, G. Kesidis, and V.
Paxson. “Preliminary Results Using Scale-Down to
Explore Worm Dynamics”. In Proceedings of the ACM
Workshop on Rapid Malcode (WORM), Fairfax, VA,
Oct. 2004
[11] C. C. Zou, W. Gong and D. Towsley, " Code red
worm propagation modeling and analysis" Proceedings
of the 9th ACM CCS 2002
[12] NS-2: the network simulator
(http://www.isi.edu/nsnam /ns/)

Linked assets

Computer Science Technical Report Archive

Conceptually similar

PDF

USC Computer Science Technical Reports, no. 859 (2005)

PDF

USC Computer Science Technical Reports, no. 788 (2003)

PDF

USC Computer Science Technical Reports, no. 806 (2003)

PDF

USC Computer Science Technical Reports, no. 804 (2003)

PDF

USC Computer Science Technical Reports, no. 837 (2004)

PDF

USC Computer Science Technical Reports, no. 749 (2001)

PDF

USC Computer Science Technical Reports, no. 905 (2009)

PDF

USC Computer Science Technical Reports, no. 775 (2002)

PDF

USC Computer Science Technical Reports, no. 770 (2002)

PDF

USC Computer Science Technical Reports, no. 789 (2003)

PDF

USC Computer Science Technical Reports, no. 781 (2002)

PDF

USC Computer Science Technical Reports, no. 797 (2003)

PDF

USC Computer Science Technical Reports, no. 752 (2002)

PDF

USC Computer Science Technical Reports, no. 765 (2002)

PDF

USC Computer Science Technical Reports, no. 887 (2007)

PDF

USC Computer Science Technical Reports, no. 790 (2003)

PDF

USC Computer Science Technical Reports, no. 910 (2009)

PDF

USC Computer Science Technical Reports, no. 814 (2004)

PDF

USC Computer Science Technical Reports, no. 707 (1999)

PDF

USC Computer Science Technical Reports, no. 780 (2002)

Description

Sapon Tanachaiwiwat, Ahmed Helmy. "Analyzing the interactions of self-propagating codes in multi-hop networks." Computer Science Technical Reports (Los Angeles, California, USA: University of Southern California. Department of Computer Science) no. 884 (2006).

Asset Metadata

Creator Helmy, Ahmed (author), Tanachaiwiwat, Sapon (author)

Core Title USC Computer Science Technical Reports, no. 884 (2006)

Alternative Title Analyzing the interactions of self-propagating codes in multi-hop networks (title)

Publisher Department of Computer Science,USC Viterbi School of Engineering, University of Southern California, 3650 McClintock Avenue, Los Angeles, California, 90089, USA (publisher)

Tag OAI-PMH Harvest

Format 12 pages (extent), technical reports (aat)

Language English

Unique identifier UC16271049

Identifier 06-884 Analyzing the Interactions of Self-Propagating Codes in Multi-hop Networks (filename)

Legacy Identifier usc-cstr-06-884

Format 12 pages (extent),technical reports (aat)

Rights Department of Computer Science (University of Southern California) and the author(s).

Internet Media Type application/pdf

Source 20180426-rozan-cstechreports-shoaf (batch), Computer Science Technical Report Archive (collection), University of Southern California. Department of Computer Science. Technical Reports (series)

Access Conditions The author(s) retain rights to their work according to U.S. copyright law. Electronic access is being provided by the USC Libraries, but does not grant the reader permission to use the work if the desired use is covered by copyright. It is the author, as rights holder, who must provide use permission if such use is covered by copyright.

Repository Name USC Viterbi School of Engineering Department of Computer Science

Repository Location Department of Computer Science. USC Viterbi School of Engineering. Los Angeles\, CA\, 90089

Repository Email csdept@usc.edu

Inherited Values

Title Computer Science Technical Report Archive

Description Archive of computer science technical reports published by the USC Department of Computer Science from 1991 - 2017.

Coverage Temporal 1991/2017

Repository Email csdept@usc.edu

Repository Name USC Viterbi School of Engineering Department of Computer Science

Repository Location Department of Computer Science. USC Viterbi School of Engineering. Los Angeles\, CA\, 90089

Publisher Department of Computer Science,USC Viterbi School of Engineering, University of Southern California, 3650 McClintock Avenue, Los Angeles, California, 90089, USA (publisher)