The Dataset on the Witty Worm

This dataset contains information useful for studying the spread of the Witty worm. The dataset is divided into two portions: a publicly available set of files that contain summarized information that does not individually identify infected computers, and a restricted-access set of files that do contain more sensitive information, including packet traces containing complete IP and UDP headers and partial payload received from hosts spreading the Witty worm.

Data included in the Witty Dataset:

• distribution of start and end times of witty-infected computers
• distribution of durations witty-infected computers were observed to be transmitting the worm
• country distribution of witty-infected computers
• estimated connection types of witty-infected computers
• RouteViews routing tables for March 20-26 (also available from www.routeviews.org)


• summaries of the start and end times each witty-infected computer was observed to be spreading the worm.
• summaries of the duration each witty-infected computer was observed to be transmitting the worm
• the country each witty-infected computer is estimated to be in
• the hostname of each witty-infected computer as of March 24, 2004
• a table with the start and end times of each hosts's activity with packet and byte traffic volumes
• packet traces containing Witty worm traffic monitored by the UCSD Network Telescope between Fri Mar 19 20:01:40 PST 2004 and Wed Mar 24 23:01:40 PST 2004.

Acceptable Use Agreement

Please read the terms of the CAIDA Acceptable Use Agreement (AUA) for Publicy Accessible Datasets below:

Referencing this Dataset

When referencing this data, please use:

The CAIDA UCSD Dataset on the Witty Worm - March 19-24, 2004,
https://catalog.caida.org/dataset/telescope_witty_worm.

You are required to report your publications using this dataset to CAIDA.

Data Access

Access the publicly available UCSD CAIDA Witty Worm Dataset

References

For more information on the Witty worm, see:

• ISS vulnerability
  • eEye: Internet Security Systems PAM ICQ Server Response Processing Vulnerability
  • (mirrored at) Bugtraq: Internet Security Systems PAM ICQ Server Response Processing Vulnerability
  • ISS: Vulnerability in ICQ Parsing in ISS Products
  • Symantec: W32.Witty.Worm
• Worm code and function
  • LURHQ: Witty Worm Analysis
  • (via Bugtraq) Kostya Kortchinsky: Black Ice Worm Disassembly
• Witty Worm Spread Analysis
  • The Spread of the Witty Worm
• Publications using the CAIDA Witty Worm Dataset
  • https://catalog.caida.org/search?query=links=dataset:telescope_witty_worm%20types=paper%20!links=tag:caida