Modeling Worm Propagation through Hidden Wireless Connections

The security issue regarding to worm propagation that exploits geographic proximity of wireless enabled devices has raised attentions in recent years. Early work has modeled worm propagation through directly infecting neighboring nodes, e.g., wireless routers and Bluetooth networks. However, there remains new potential wireless connection topology that can assist the spread of worm in a covert way and threat the cyberspace. In this paper, we study a potential worm epidemic pathway that lies in the densely overlapped wireless metropolitan networks and covers large geographic areas. Specifically, the overlapped footprints of neighboring access points can create hidden connections for worms to propagate across the entire wireless network. We present a novel analytical model to analyze the spread speed of this type of worm. The constraints of the nodes within the overlapped footprints, the boundaries set aside by the access point associations, network topology, and density of both access points and users are considered in the model. We also present methods to obtain estimations about propagation delays in an access point coverage and to generate numerical results based on the model. In evaluation, real maps of access points are used to simulate worm propagation and validate the model. The results call for research on detection and defense solutions against worm propagation in wireless networks.