Computer worms: models and countermeasures
A. Ganesh, Microsoft, U.K.
February 25, 2005

Abstract

Computer worms spread by scanning Internet addresses at random
and, if a vulnerable machine is found at that address, infecting it.
While they can potentially spread very fast, their scanning behaviour
provides a way of distinguishing them from legitimate applications and,
possibly, of quarantining infected machines in time. I will pose this as
a change-point detection problem and discuss some classical statistical
techniques for solving it. We'll then discuss some extensions, as well
as some of the issues involved in applying these techniques in practice.