Conficker Worm Visualizations

Many in the Internet security industry have been tracking the Conficker worm since its arrival in October 2008. We have been working with our partners in the industry on visualization and investigation of this worm, and have produced the visualizations below using some of these data sets.

We have produced an animated movie of Conficker infections from January 20th 2009 through February 3rd 2009. This movie looks very similar to the static one-day charts shown below, and has audio commentary from Team Cymru's own Steve Santorelli describing what you can see. You can download the movie here (7.7MB Quicktime MOV)

The below charts have been produced using one distinct data set, showing Conficker infections from January 29th 2009. Again, note that this is only one day's infected host data.

The global heatmap above shows Conficker infected IPs for January 29th 2009. White areas indicate a high infection rate and the colors change through to blue, representing a low infection rate. You can click on the image to download a full-size version (3451 KB JPEG).

The image above is the same data without the global map background. The number of infections (1.7 million) is so high that you can clearly see the outline of continents without the map. You can click on the image to download a full-size version (1648 KB JPEG).

The pie chart above shows the top 10 infections by country for January 29th 2009. You can also download the infections-per-country data (2 KB CSV) to see how all of the countries present in the data compare.

Thanks to Support Intelligence and the wider community for this invaluable data, and thanks to NASA for the background map images.