Summarized data in the CAIDA Dataset on the Witty Worm

********
No portion of the CAIDA Dataset on the Witty Worm may be redistributed.

All users who publish (in any venue, including presentations, web pages, 
and papers) data from this dataset must cite:
        The CAIDA Dataset on the Witty Worm - March 19-24, 2004,
        Colleen Shannon and David Moore,
        http://www.caida.org/passive/witty/.   Support for the Witty
        Worm Dataset and the UCSD Network Telescope are provided
        by Cisco Systems, Limelight Networks, the US Department of
        Homeland Security, the National Science Foundation, and
        CAIDA, DARPA, Digital Envoy, and CAIDA Members.
********

Publicly available:

	These files contain no IP addresses or other sensitive information.

	witty.country.distribution.txt
		The country distribution of the witty-infected
		hosts, as mapped by Digital Envoy's NetAcuity service
		[1].  The data consists of a tab separated file
		containing the three letter ISO country abbreviations,
		the percentage of the Witty-infected population
		estimated to reside in that country, and the total
		count of infected computers in that country.

	witty.connection.speeds.txt
		The estimated connectivity distribution of Witty
		infected hosts -- broadband, dsl, dialup, t1, etc.
		File consists of a tab separated lits of Internet
		connection types, percentage of Witty-infected
		population estimated to use that type of connection,
		and total count of infected computers with those
		types of links.

	witty.start.cdf.txt
		A cumulative distribution of the times at which we
		first saw Witty probes from various IP addresses.
		A space separated file containing a unix timestamp
		for each IP address and the number of IP addresses
		with start times earlier or equal to that timestamp.

	witty.relative.start.cdf.txt
		The amount of time between the first observation
		of worm traffic on the telescope and the first time
		we saw a worm packet from a given IP address.  A
		space separated file with the duration of time
		between first witty packet and the onset of a given
		IP address and the number of hosts with an start
		earlier than or equal to that time.

	witty.end.cdf.txt
		A cumulative distribution of end last times we
		observed Witty probes from various IP addresses.
		A space separated file containing the unix timestamp
		for each IP address and the number of IP addresses
		with end times earlier or equal to that timestamps.

	witty.relative.end.cdf.txt
		The amount of time between the first observation
		of worm traffic on the telescope and the last time
		we saw a worm packet from a given IP address.  A
		space separated file containing the cumulative
		distribution of the time between worm onset and the
		cessation of an IP address in seconds and the count
		of computers with relative durations less than or
		equal to the first column.

	witty.durations.cdf.txt
		The duration of time Witty infected IP addresses
		were observed to be transmitting the worm.  The
		file contains a tab separated cumulative distribution
		with one line per IP address with columns for number
		of seconds active, count of IP addresses at less
		than or equal to this infection duration, and percent
		of IP addresses less than or equal to this infection
		duration.


[1]	Digital Envoy's NetAcuity Service:
http://www.digitalenvoy.net/solutions/netacuity.shtml