Figure 1: Mixed abstraction level model.
This package models the spread of a worm in a network using a macroscopic epidemic model. Since the epidemic may encompass hundreds of thousands of hosts, the idea is to partially decouple the worm spread from the packet-level network model. Thus, we model the "whole Internet" at a coarse macroscopic level (for the worm spread) and some part of it in more detail (the "microscopic" or network level) using SSFNet entities such as routers and hosts. This is illustrated in Figure 1.
Figure 1: Mixed abstraction level model.
The rationale behind this mixed abstraction level model and the benefits and trade-offs involved are described in the paper [Liljenstam et al., 2002].
Version 0.4 supports the following features:
The link between the network and epidemic models is provided by the WormProtocolSession pseudo-protocol-session. The first instance created of this session will create the global epidemic model entity and a timer object to drive it forward. All session instances will register with the epidemic model to signal that they represent a vulnerable host. As the infection progresses the epidemic model will pick hosts at random for infection and may thus pick hosts that are modeled at the network level. When this happens it will call the method WormProtocolSession.becomeInfected() which is an empty placeholder for events to happen when a host has become infected.
See the config() method of WormProtocolSession (and examples) for more information on how to configure the parameters for the epidemic model.
Installation:
Unpack the package tar-ball in the src/SSF/App directory.
Examples:
The example provided here requires a system with Perl and gnuplot
installed.
Go to the test subdirectory.
The perl-script testplot.pl will run the
campusUnderAttack.dml, and extract data on host infections from the
debug output and plot the results using gnuplot. The scenario is the exact
same network as the campus2.dml network in the
littleComboDemo SSFNet example, with the difference that all hosts
(clients and servers) are vulnerable to the worm. Thus, the only difference
in configuration is that the WormProtocolSession has been added
to the hosts' protocol stacks.
The example (approximately) models the spread of the Code Red v2 worm and infections occurring on the campus network.
The resulting graph should look like Figure 2.
For a minimal example in the same vein, see singleHost.dml which models a single home user during an ongoing worm attack (parameters for Code Red v2). In this example the network model does nothing except start up the epidemic and wait for something to happen. If the epidemic runs long enough, the user's host will eventually become infected.
The infection will show up in the debug output (as shown in this output clip), but otherwise will have no effect on the model, since no action is coded into the the host.
