The Spread of the Witty Worm - CAIDA
Contains an analysis of the spread of the Witty Worm, based on packets received by UCSD's "network telescope". Fairly interesting, since Witty exploited a firewall vulnerability that appeared in only a few hosts, and it (eventually) crashes the machines it runs on.