Computer Worm (SIR Epidemic Model) & Botnet C2 Jitter Simulator (2026)

Originally developed by Kermack and McKendrick for biological epidemics, the SIR model divides a network of N hosts into three compartments: Susceptible (S: unpatched and reachable), Infectious (I: actively scanning and exploiting peers at rate β), and Removed/Recovered (R: patched, quarantined by EDR, or offline at rate γ). The coupled differential equations dS/dt = −βSI/N, dI/dt = βSI/N − γI, and dR/dt = γI accurately predict worm velocity.

In cybersecurity, R0 = (β / γ) × (1 − p) represents the average number of vulnerable machines a single infected host compromises before being isolated or patched. If R0 > 1, a worm triggers an exponential network-wide outbreak; if micro-segmentation and automated EDR containment push R0 < 1, the outbreak dies out organically.

SQL Slammer fit inside a single 376-byte UDP packet targeting MS SQL Server Resolution Service port 1434. Because UDP is connectionless, Slammer never waited for TCP SYN-ACK timeouts—it fired random IPv4 packets as fast as the NIC allowed, achieving an initial doubling time of 8.5 seconds.

Before running its EternalBlue SMBv1 propagation routine, WannaCry queried an unregistered hardcoded domain (`iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com`) as an anti-sandbox check. When that domain was registered and pointed to a sinkhole server returning HTTP 200, new infections immediately exited—instantaneously spiking the removal rate γ.

While a 20%–30% random sleep jitter defeats simple fixed-interval cron checks, Network Detection and Response (NDR) tools analyze 24-hour connection time series using Fast Fourier Transforms (FFT), skewness of inter-arrival times, and uniform payload byte-size consistency to flag persistent C2 channels.