Abstract:Logical worm propagation model can characterize how the worm-like malicious code spreads in network exactly, which contributes the analysis of worm propagation mechanism in depth to engaging in the study of worm defense, detection and containment. The significance of infection time is often neglected in worm propagation models based on classic epidemic model. By introducing and analyzing infection time, a worm propagation model called SSI is derived using deterministic modeling methods. This model reflects the possible state-transition of vulnerable hosts during worm propagation, and results in a better understanding and modeling of the propagation of Internet worms.