Certain programs exhibit revealing patterns in how they propagate in the network. We developed the SharkFin model [ASONAM 2013] for the propagation rate of executable files on the Internet. This model incorporates three patterns observed in the field data: (1) an exponential rise, leading to a spike; (2) a power-law drop, after the peak propagation rate is achieved; and (3) a daily periodicity pattern. The parameters of these propagation patterns (e.g. the shape of the curve or the velocity of propagation) likely correspond to the mechanism used to disseminate the file.
[ASONAM 2013] E. E. Papalexakis, T. Dumitraș, D. H. Chau, B. A. Prakash, and C. Faloutsos, “Spatio-temporal mining of software adoption and penetration,” in Advances in Social Networks Analysis and Mining (ASONAM), Niagara, Canada, 2013, pp. 878–885.