A Probabilistic Population Study of the Conficker-C Botnet
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
We estimate the number of active machines per hour infected with the Conficker-C worm, using a probability model of Conficker-C’s UDP P2P scanning behavior. For an observer with access to a proportion of monitored IPv4 space, we derive the distribution of the number of times a single infected host is observed scanning the monitored space, based on a study of the P2P protocol, and on network and behavioral variability by relative hour of the day. We use these distributional results in conjunction with the Levy form of the Central Limit Theorem to estimate the total number of active hosts in a single hour. We apply the model to observed data from Conficker-C scans sent over a 51-day period (March 5th through April 24th, 2009) to a large private network.
Cite This SEI Report
Weaver, R. (2010, February 1). A Probabilistic Population Study of the Conficker-C Botnet. Retrieved August 18, 2026, from https://www.sei.cmu.edu/library/a-probabilistic-population-study-of-the-conficker-c-botnet/.
@techreport{weaver_2010,
author={Weaver, Rhiannon},
title={A Probabilistic Population Study of the Conficker-C Botnet},
month={Feb},
year={2010},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/a-probabilistic-population-study-of-the-conficker-c-botnet/},
note={Accessed: 2026-Aug-18}
}
Weaver, Rhiannon. "A Probabilistic Population Study of the Conficker-C Botnet." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, February 1, 2010. https://www.sei.cmu.edu/library/a-probabilistic-population-study-of-the-conficker-c-botnet/.
R. Weaver, "A Probabilistic Population Study of the Conficker-C Botnet," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 1-Feb-2010 [Online]. Available: https://www.sei.cmu.edu/library/a-probabilistic-population-study-of-the-conficker-c-botnet/. [Accessed: 18-Aug-2026].
Weaver, Rhiannon. "A Probabilistic Population Study of the Conficker-C Botnet." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 1 Feb. 2010. https://www.sei.cmu.edu/library/a-probabilistic-population-study-of-the-conficker-c-botnet/. Accessed 18 Aug. 2026.
Weaver, Rhiannon. A Probabilistic Population Study of the Conficker-C Botnet. Software Engineering Institute. 2010. https://www.sei.cmu.edu/library/a-probabilistic-population-study-of-the-conficker-c-botnet/