Computer worm

A computer worm is a self-contained computer program that propagates by creating further copies across computing systems, often through a computer network. In the usual security classification it is malware. Unlike a computer virus, it need not attach its code to another program in order to replicate.^[ref]

A worm's impact can include resource exhaustion from replication itself, independently of any additional destructive action. Eugene H. Spafford's analysis of the November1988 Internet worm is an early primary study of a large network incident and its program behavior.^[ref]

An original population model shows why replication matters. Suppose each affected machine remains affected and produces exactly one newly affected machine per time interval, with no overlap or shortage of susceptible machines. If $I_t$ counts affected machines, thenThis stipulated exponential growth model is not a forecast of a real outbreak. Repeated contacts, limited connectivity and containment change the growth pattern. It separates the potential for multiplying copies from the behavior of any particular implementation.

The concept is useful in computer security because one compromised machine can become a source of further disruption. Network structure and the timing of defensive containment matter alongside the behavior observed on an individual host.