Motivation

Why measure global worm activity?
To understand worm growth and attrition
window of opportunity for attack
To assess the potential threat to the Internet
DDoS zombies
To identify patterns in infection
quarantine / cleanup