A Study of Massmailing Worms

Mass-mailer worms get the short end of the stick here on Wormblog. They're usually derivatives of eachother, at this point, and while they can disrupt an enterprise's e-mail infrastructure, they don't usually display much novelty. Detection is also pretty easy. So, a paper like this is nice to see.

Mass-mailing worms have made a significant impact on the Internet. These worms consume valuable network resources and can also be used as a vehicle for DDoS attacks. In this paper, we analyze network traffic traces collected from a col- lege campus and present an in-depth study on the effects of two mass-mailing worms, SoBig and MyDoom, on outgoing traffic. Rather than proposing a defense strategy, we focus on studying the fundamental behavior and characteristics of these worms. This analysis lends insight into the possibili- ties and challenges of automatically detecting, suppressing and stopping mass-mailing worm propagation in an enter- prise network environment.

Source: A Study of Massmailing Worms, Cynthia Wong, Stan Bielski, Jonathan M. McCune, Chenxi Wang, from WORM04.