We present a simple, deterministic mathematical model for the spread of randomly scanning and bandwidth-saturating Internet
worms. Such worms include Slammer and Witty, both of which spread extremely rapidly. Our model, consisting of coupled Kermack-McKendrick
equations, captures both the measured scanning activity of the worm and the network limitation of its spread, i.e., the effective
scan-rate per worm/infective. We fit our model to available data for the Slammer worm and demonstrate its ability to accurately
represent Slammer’s total scan-rate to the core.
This work is supported by both the NSF and DHS of the United States under NSF grant number 0335241.