Impeding worm epidemics through destination address filtering

A simple way to detect worms, provided you have enough coverage (or are monitoring outbound traffic of a medium size network or larger).

The effectiveness of destination IP address filtering against fast worm epidemics is analyzed. It is shown that its impeding effect depends heavily on the deployment ratio. If wide deployment is only achieved, which we argue is not as impractical as one might think, it can fundamentally block so called fast epidemics.

Source: Impeding worm epidemics through destination address filtering, Hyogon Kim and Inhye Kang.