The Witty worm is an example where our Darknets alerted us within minutes of the release of the worm. This set of graphics from three distinct Darknets makes it quite clear that something was amiss.
Witty’s network impact was really quite dramatic. Cymru, in an article aimed mainly at network administrators, shows the worm’s very dramatic traffic increase as recorded on three servers–look for graphs about a quarter of the way into the essay. Worth a look, even if (like me) you can’t make more than superficial sense of most of the discussion. That propogation pattern is remarkable; anyone who can make a program launch look like that deserves our respect..
There’s a mind behind Witty, folks. Wonder what she learned from the experiment.