  The traditional worms such as Blaster, Code Red, Slammer and Sasser, are
still infecting vulnerable machines on the internet. They will remain as
significant threats due to their fast spreading nature on the internet. Various
traditional worms attack pattern has been analyzed from various logs at
different OSI layers such as victim logs, attacker logs and IDS alert log.
These worms attack pattern can be abstracted to form worms' attack model which
describes the process of worms' infection. For the purpose of this paper, only
Blaster variants were used during the experiment. This paper proposes a
multi-step worm attack model which can be extended into research areas in alert
correlation and computer forensic investigation.
