The Spread of the Witty Worm

By Colleen Shannon, David Moore. 2004

411 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Security analysis of online centroid anomaly detection (2010, background): “The time span required for crafting a signature from a newly discovered attack is insufficient for protecting against rapidly propagating malicious code (e.g., Moore et al., 2002; Shannon and Moore, 2004).”
Modeling Botnet Propagation Using Time Zones (2006, result): “Improvements belonging to the rst category can be found in more recent analysis such as [ SM04 ], which traced signicant worm outbreaks, and [ZTGC05,WPSC03,WSP04], which examined a specic type of routed worm, and [ZTG04], which examines specic types of propagation (e.g., e-mail).”
The monitoring and early detection of Internet worms (2005, neutral): “After that, Code Red II, Nimda, Slammer, Blaster, Sasser, and Witty have repeatedly attacked the Internet [9] and caused great damage to our society.”
Understanding the Mirai Botnet (2017, background): “5 megabytes/second, about 6000 times faster [68], and the Witty worm scanned even faster at 3 megabytes/second [81].”
An Inside Look at Botnets (2007, background): “{e.g., [25, 23, 24 , 9]), perhaps the most serious threat to the Internet today are col lections of compromised systems that can be controlled by a single person.”
A Taxonomy of Botnet Structures (2007, methodology): “Here, we do not use size to mean the total population count, such as that usually used in worm epidemiology studies [37–39, 50].”
The Internet Motion Sensor - A Distributed Blackhole Monitoring System (2005, methodology): “For example, the Witty [21] and Slammer [12] worms were based on UDP in which the entire worm payload was transmitted in the first packet.”