Worm Epidemics in Wireless Adhoc Networks

A dramatic increase in the number of computing devices with wireless communication capability has resulted in the emergence of a new class of computer worms which specifically target such devices. The most striking feature of these worms is that they do not require Internet connectivity for their propagation but can spread directly from device to device using a short-range radio communication technology, such as WiFi or Bluetooth. In this paper, we develop a new model for epidemic spreading of these worms and investigate their spreading in wireless ad hoc networks via extensive Monte Carlo simulations. Our studies show that the threshold behaviour and dynamics of worm epidemics in these networks are greatly affected by a combination of spatial and temporal correlations which characterize these networks, and are significantly different from the previously studied epidemics in the Internet.

💡 Research Summary

The paper addresses a newly emerging class of computer worms that spread directly between wireless devices using short‑range radio technologies such as Wi‑Fi or Bluetooth, without requiring Internet connectivity. To study the epidemic dynamics of such worms, the authors model wireless ad‑hoc networks as two‑dimensional random geometric graphs (RGG) and incorporate the effects of the IEEE 802.11 Medium Access Control (MAC) protocol, specifically the listen‑before‑talk (LBT) rule, which introduces spatial‑temporal correlations absent in traditional Internet models.

In the network model, N nodes are uniformly distributed over a 1000 m × 100 m area. All nodes use the same transmit power, leading to a common transmission radius r_t derived from a path‑loss model (P_ij = P c r_ij^‑α). Nodes within r_t are linked, yielding an undirected RGG with Poisson degree distribution, average degree ⟨k⟩ = π r_t² ρ (ρ = N/L²). The authors note that, unlike Erdős‑Rényi (ER) random graphs, RGGs have a high clustering coefficient (≈0.59) and a connectivity threshold at ⟨k⟩ ≈ 4.5, reflecting strong spatial constraints.

The MAC layer is simplified to capture the essential LBT behavior: at each discrete time step, infected nodes are randomly ordered; the first node in the list is allowed to transmit, and any other infected node whose transmission would interfere (i.e., lies within the first node’s transmission range) is blocked for that step. Blocked nodes still participate in the subsequent patching (recovery) phase. This mechanism creates a set of non‑interfering transmitters per time step, mimicking the real‑world contention avoidance of Wi‑Fi.

Worm propagation follows a classic susceptible‑infected‑removed (SIR) scheme. An infected node attempts to infect each susceptible neighbor with rate λ; infected nodes become immune (patched) with rate δ. The authors fix δ = 1 and vary λ to explore the λ/δ ratio, which governs epidemic behavior. Simulations start from a single random seed and run until no infected nodes remain, averaging results over 500 Monte‑Carlo runs and multiple seeds.

Key findings from the extensive simulations (N = 4 000 to 20 000, transmission range 50 m) are:

1. Higher Epidemic Threshold – Both the pure RGG and the RGG with MAC exhibit a critical infection rate λ_c significantly larger than that of an ER graph with the same degree distribution (λ_c ≈ 0.014 for ER, ≈0.021 for RGG, ≈0.026 for RGG+MAC). The spatial embedding and high clustering raise the threshold, confirming that mean‑field predictions underestimate the resilience of wireless ad‑hoc networks.

2. Slower Early Growth – The number of infected nodes grows far more slowly than the exponential rise typical of Internet worms. The initial phase follows a sub‑exponential, almost linear increase, reflecting the limited number of reachable neighbors and the contention imposed by MAC.

3. Self‑Throttling Effect – The MAC’s LBT rule prevents simultaneous transmissions from nearby infected nodes, effectively throttling the spread. Even blocked nodes still undergo the patching step, so a fraction of the population becomes immune without contributing to further spread, accelerating the decline of active infections.

4. Density Dependence – Increasing node density (and thus ⟨k⟩) reduces λ_c modestly but does not eliminate the gap between RGG and ER thresholds. The epidemic prevalence R_∞(λ) collapses onto a universal curve when plotted against κ = λ ⟨k⟩, confirming that the λ/δ ratio remains the governing parameter, albeit with shifted critical values.

5. Implications for Security – Because wireless ad‑hoc networks naturally limit worm propagation through spatial constraints and MAC‑induced contention, security strategies that ignore these factors may overestimate risk. Conversely, attackers could attempt to bypass MAC (e.g., by using multiple non‑overlapping channels) to lower the effective λ_c, highlighting a potential arms race.

The authors conclude that epidemic models developed for the Internet cannot be directly applied to wireless ad‑hoc environments. Accurate prediction of worm outbreaks requires explicit modeling of geometric connectivity and MAC‑level dynamics. Future work is suggested to incorporate node mobility, heterogeneous transmission powers, multi‑channel operation, and empirical validation on real devices, aiming to inform robust defense mechanisms tailored to the unique characteristics of wireless ad‑hoc networks.