Modeling and analysis of worm propagation in IPv6 networks

It is a common belief that IPv6 could defend against random-scanning worms due to its huge address space. However, a new type of worm, V6-Worm, possibly propagating in IPv6 network rapidly, is presented in this paper. Based on the analysis of the scanning strategy of V6-Worm, two models-Simple Epidemic Model (SEM) and Two-Factor Model (TFM) are established for simulating the propagation of V6-Worm. The simulation results of SEM show that V6-Worm can propagate more rapidly in the IPv6 network than the random-scanning worm in the current IPv4 network. Furthermore the simulation results of TFM show that V6-Worm can counter the worm defense strategies better than the random-scanning worms. The results also indicate that the percentage of vulnerable hosts is the key factor affecting V6- Worm's propagating capability. Some defense strategies are discussed focusing on preventing address leakage and reducing the percentage of vulnerable hosts.