On the impact of dynamic addressing on malware propagation

摘要: While malware models have become increasingly accurate over the past few years, none of existing proposals accounts for use Network Address Translation (NAT). This oversight is problematic since many network customers NAT in their local networks. In fact, measurements we collected from a distributed honeynet show that approximately 19% infected hosts reside NATted domains. To account this present model can be used to understand impact varying levels deployment on spread by preferentially scanning IP space. Using model, NATting impedes propagation several ways and significant non-uniform worms as it invalidates implicit assumption vulnerable densely populated subnets.