Witty growth and decay rate modeled by Zou

Cliff Zou has modeled the Witty worm's propagation using differential equations, accounting for the destructive aspect of the worm. This analysis gives a compelling reason as to the decay rate and accounts for significant portions of the observations. The data used in the analysis comes from the University of Michigan Internet Motion Sensor project's collection.

In our Witty propagation modeling, we have not considered other factors that could possibly affect Witty's propagation. For example, some infected computers could have been patched or filtered out by people before they were crashed by Witty worm.  However, if this factor played a major role, then the I(t) shown in Fig. 2 should have decreased more quickly instead of slower than what our model predicts. Therefore, the same as researchers in [2] said, we believe the rapid decay in the number of active infected hosts is primarily caused by Witty's destructive action.

Source: Witty Worm Progattion Modeling, Cliff C. Zou.