Malware Propagation Model Research Articles

An information diffusion model in social networks with carrier compartment and delay

With the wide applications of the communication networks, the topic of information networks security is getting more and more attention from governments and individuals. This paper is devoted to investigating a malware propagation model with carrier compartment and delay to describe the process of malware propagation in mobile wireless sensor networks. Based on matrix theory for characteristic values, the local stability criterion of equilibrium points is established. Applying the linear approximation method of nonlinear systems, we study the existence of Hopf bifurcation at the equilibrium points. At the same time, we identify some sensitive parameters in the process of malware propagation. Finally, numerical simulations are performed to illustrate the theoretical results.

The dynamics of an SEIRS-QV malware propagation model in heterogeneous networks

In this paper, we introduce a new dynamic model of malware propagation in heterogeneous networks based on a rumor diffusion model, which comprises both vaccination and quarantine methods. The proposed model is referred to as the susceptible–exposed–infected–recovered–susceptible with vaccination and quarantine states (SEIRS-QV) model. The model considers the impacts of user awareness, network delay and diverse configuration of nodes to study dynamical behavior of malware propagation. We carry out the systematic analysis of the model and indicate the stability of the malware-free equilibrium. Using numerical simulations, we examine the theoretical analysis. By numerical simulations, we show that our model is appreciably better than other models in terms of reducing malware propagation speed. Furthermore, we investigate many related dynamics properties to make the results more completed.

Cellular automata malware propagation model for WSN based on multi‐player evolutionary game

When wireless sensor network (WSN) is running, it needs data acquisition, fusion, and transmission, which makes the attacker distribute the malware code to the network to destroy the normal operation of the network. In this study, an improved two-dimensional (2D) cellular automata model and a multi-player evolutionary game model are proposed to describe the propagation process of malware propagation, aiming at the shortcomings of research on malware propagation in WSN. First, the authors introduce the node diversity model according to the difference between the cluster-head node and the terminal node in WSN. Then, based on the existing 2D cellular automata malware model, an improved mechanism of epidemiological transmission is improved. To make the model more complete, a multi-player evolutionary game model is established according to the different attack methods and the different coping strategies adopted by the cluster-head node and the terminal node in WSN. The replication dynamic equation of the strategy evolution is also given. Simulation results show that the proposed model can accurately describe the propagation behaviour of malware in WSN and provide a basis for security defence research of WSN.

Partial differential equation modeling of malware propagation in social networks with mixed delays

With the wide applications of social networks, government and individuals increasingly emphasize information networks security. This paper is devoted to investigating a reaction–diffusion malware propagation model with mixed delays to describe the process of social networks. Applying matrix theory for characteristic values, we establish the local stability conditions of a positive equilibrium point. Based on the linear approximation method of nonlinear systems, the Hopf bifurcation at the positive equilibrium point is considered. Additionally, we identify some sensitive parameters in the process of malware propagation that are significant for control theory. Finally, numerical simulations are performed to illustrate the theoretical results.

Global dynamics of a network-based WSIS model for mobile malware propagation over complex networks

For understanding the influence of user security awareness on the long-term spreading behavior of malware over mobile networks, in this paper, we intensively study the global dynamics of a novel network-based epidemic model with weakly-protected and strongly-protected susceptible nodes. Both analytical and numerical results show that the global dynamics of the model is completely governed by a threshold value. Specifically, we prove that when the value is lower than one, the malware-free equilibrium is globally asymptotically stable and mobile malware will disappear. When the value is greater than one, mobile malware will persist on the network, and in the meantime there exists a unique malware equilibrium which is globally asymptotically stable under certain conditions. The obtained results improve and enrich some known ones. Interestingly, increasing the recovery rate of infected nodes can result in the increase of strongly-protected susceptible nodes and the decrease of the threshold value. The study has valuable guiding significance in effectively controlling mobile malware spread.

Preventing malware pandemics in mobile devices by establishing response-time bounds

The spread of malicious software among computing devices nowadays poses a major threat to the systems’ security. Since both the use of mobile devices and the growth of malware’s propagation increase rapidly, we are interested in investigating how the time needed by a counter-measure (i.e., an antivirus or a cleaner) to detect and remove a malware from infected devices affects the malware’s propagation. In this work, we study the effect of counter-measure’s response-time on the propagation of a malicious software and propose a model for establishing reasonable response-time bounds for its activation in order to prevent pandemic. More precisely, given an initial infected population in a network of mobile devices and a specific city area (town’s planning), our model establishes upper response-time bounds for a counter-measure which guarantee that, within a period of time, not all the susceptible devices in the city get infected and the infected ones get sanitized. To this end, we first propose a malware propagation model along with a device mobility model, and then we develop a simulator utilizing these models in order to study the spread of malware in such networks. Finally, we present experimental results for the pandemic prevention taken by our simulator for various response-time intervals and other factors that affect the spread deploying different epidemic models.

Malware propagation in Wireless Sensor Networks: global models vs Individual-based models

The main goal of this work is to propose a new framework to design a novel family of mathematical models to simulate malware spreading in wireless sensor networks (WSNs). An analysis of the proposed models in the scientific literature reveals that the great majority are global models based on systems of ordinary differential equations such that they do not consider the individual characteristics of the sensors and their local interactions. This is a major drawback when WSNs are considered. Taking into account the main characteristics of WSNs (elements and topologies of network, life cycle of the nodes, etc.) it is shown that individual-based models are more suitable for this purpose than global ones. The main features of this new type of malware propagation models for WSNs are stated.

Variable step length algorithms with high-order extrapolated non-standard finite difference schemes for a SEIR model

In the present manuscript, higher-order methods are derived to solve a SEIR model for malware propagation. They are obtained using extrapolation techniques combined with nonstandard finite difference (NSFD) schemes used in Jansen and Twizell (2002). Thus, the new algorithms are more efficient computationally, and are dynamically consistent with the continuous model. Later, different procedures are considered to control the error in the discrete schemes. Numerical experiments are provided to illustrate the theory, and for the comparison of the different strategies in the adaptation of the variable step length.

Malware Propagation and Prevention Model for Time-Varying Community Networks within Software Defined Networks

As the adoption of Software Defined Networks (SDNs) grows, the security of SDN still has several unaddressed limitations. A key network security research area is in the study of malware propagation across the SDN-enabled networks. To analyze the spreading processes of network malware (e.g., viruses) in SDN, we propose a dynamic model with a time-varying community network, inspired by research models on the spread of epidemics in complex networks across communities. We assume subnets of the network as communities and links that are dense in subnets but sparse between subnets. Using numerical simulation and theoretical analysis, we find that the efficiency of network malware propagation in this model depends on the mobility rate q of the nodes between subnets. We also find that there exists a mobility rate threshold qc. The network malware will spread in the SDN when the mobility rate q>qc. The malware will survive when q>qc and perish when q<qc. The results showed that our model is effective, and the results may help to decide the SDN control strategy to defend against network malware and provide a theoretical basis to reduce and prevent network security incidents.

A model for malware propagation in scale-free networks based on rumor spreading process

In this paper, we propose a dynamic model of malware propagation in scale-free networks (SFNs) based on a rumor spreading model. The proposed model, which is called the susceptible–exposed–infectious–recovered–susceptible with a vaccination state (SEIRS-V) model, illustrates the dynamics of malware propagation with respect to time in SFNs. The model considers the impact of software diversity to halt the outbreak of malware in networks. Using the SEIRS-V model, we derive the basic reproductive ratio that governs whether or not a malware is extinct. Furthermore, we calculate the number of diverse software packages installed on computer nodes that can be introduced as a parameter to prevent malware spreading. We accomplish the systematic analysis of the model and represent the local and global stability of malware-free equilibrium. Using numerical simulations, we examine the theoretical analysis. The effects of diversification and vaccination on the model are investigated. Simulation results demonstrate that the model is more effective than other existing models of malware propagation, in terms of reducing the density of infected node.

Modeling the propagation of mobile malware on complex networks

In this paper, the spreading behavior of malware across mobile devices is addressed. By introducing complex networks to model mobile networks, which follows the power-law degree distribution, a novel epidemic model for mobile malware propagation is proposed. The spreading threshold that guarantees the dynamics of the model is calculated. Theoretically, the asymptotic stability of the malware-free equilibrium is confirmed when the threshold is below the unity, and the global stability is further proved under some sufficient conditions. The influences of different model parameters as well as the network topology on malware propagation are also analyzed. Our theoretical studies and numerical simulations show that networks with higher heterogeneity conduce to the diffusion of malware, and complex networks with lower power-law exponents benefit malware spreading.

Malware propagation modeling considering software diversity and immunization

In this paper, we propose a discrete-time susceptible–exposed–infected–recovered–susceptible (SEIRS) epidemic model of malware propagation in scale-free networks (SFNs) with considering software diversity. We study dynamical behavior of the SEIRS model, which is determined by a threshold (i.e., basic reproductive ratio). With this threshold, we can predict whether the malware propagates or not. Also, using a coloring algorithm, the number of diverse software packages installed on nodes is calculated and used as a parameter to prevent malware spreading. Furthermore, we investigate global dynamics of the model and analyze the stability of the malware-free equilibrium. The dynamics of malware propagation is evaluated using the results of numerical simulations. Simulation results show that the proposed model, which considers software diversity, is more effective than other existing epidemic models. We have compared different immunization mechanisms, and have shown that the targeted immunization is better than the random immunization for controlling malware spreading in SFNs.

Effect of anti-malware software on infectious nodes in cloud environment

A primary challenge of cloud computing is securing a virtualized environment. Virtual machine migration plays an important role in cloud infrastructure by enabling dynamic resource allocation and optimizing power consumption. However, it may adversely affect the security of the environment by facilitating the malware propagation process. In this paper, we introduce a novel approach to study the fast propagation of malware in the virtualized cloud environments. We develop Susceptible-Protected-Infected (SPI) cloud malware propagation model, a dynamic mathematical model to analyze the effect of self-defending VMs in the cloud environment with variable VM population and migration patterns. We analyze the proposed model using stability theory of differential equations and use epidemic modeling of malware propagation to evaluate strategies for malware propagation control. Finally, the experimental results confirm the validity of our analytical results.

Stability and bifurcation analysis in a delayed reaction–diffusion malware propagation model

Mobile wireless sensor networks (MWSNs) have become an area of intense research activity due to technical advances in sensors, wireless communications and networking, and signal processing. Many applications, including environment monitoring, battlefield surveillance, and urban search and rescue especially in hazardous situations, are envisaged. However, MWSNs may be vulnerable to malicious interference because of the large-scale characteristics. When a contaminated node communications with its neighbors, multiple copies of the malware are transmitted to its neighbors, which may destroy, block regular communications, or even damage the integrity of regular data packets. Modeling spatial distribution of malware propagation over time is the first step to predict the trend of malware propagation in MWSNs. We propose a novel wireless malware propagation model with the discrete time delay based on reaction–diffusion equations in mobile wireless sensor networks, and study its dynamic behaviors. By analyzing the stability and Hopf bifurcation of the equilibrium of our model, we search for the sufficient conditions, which leads to the malware propagation disappears or continues. Furthermore, we demonstrate that oscillations in this model occur through the destabilization of the stationary solution at a Hopf bifurcation point. And formulas for determining the stability of the bifurcating periodic oscillations are derived by applying the normal form method and center manifold theorem. Finally, we conduct extensive simulations on large-scale MWSNs to evaluate the proposed model. Numerical evidence shows that the spatial–temporal dynamic characteristics of malware propagation in MWSNs are closely related to the packet transmission rate, the communication rang and the mobile behavior of nodes.

Malware Propagation in Large-Scale Networks

Malware is pervasive in networks, and poses a critical threat to network security. However, we have very limited understanding of malware behavior in networks to date. In this paper, we investigate how malware propagates in networks from a global perspective. We formulate the problem, and establish a rigorous two layer epidemic model for malware propagation from network to network. Based on the proposed model, our analysis indicates that the distribution of a given malware follows exponential distribution, power law distribution with a short exponential tail, and power law distribution at its early, late and final stages, respectively. Extensive experiments have been performed through two real-world global scale malware data sets, and the results confirm our theoretical findings.

Differential Game-Based Strategies for Preventing Malware Propagation in Wireless Sensor Networks

Wireless sensor networks (WSNs) are prone to propagating malware because of special characteristics of sensor nodes. Considering the fact that sensor nodes periodically enter sleep mode to save energy, we develop traditional epidemic theory and construct a malware propagation model consisting of seven states. We formulate differential equations to represent the dynamics between states. We view the decision-making problem between system and malware as an optimal control problem; therefore, we formulate a malware-defense differential game in which the system can dynamically choose its strategies to minimize the overall cost whereas the malware intelligently varies its strategies over time to maximize this cost. We prove the existence of the saddle-point in the game. Further, we attain optimal dynamic strategies for the system and malware, which are bang–bang controls that can be conveniently operated and are suitable for sensor nodes. Experiments identify factors that influence the propagation of malware. We also determine that optimal dynamic strategies can reduce the overall cost to a certain extent and can suppress the malware propagation. These results support a theoretical foundation to limit malware in WSNs.

Dynamical analysis and optimal control for a malware propagation model in an information network

Abstract With the rapid development of network information technology, information networks security has become a very critical issue in our work and daily life. This paper investigates a nonlinear malware propagation model in wireless sensor networks (WSNs) based on SIR epidemic model. Sufficient conditions for the local stability of the positive equilibrium point and the existence of Hopf bifurcation are obtained by analyzing the associated characteristic equation. Moreover, formulas for determining the properties of the bifurcating periodic oscillations are derived by applying the normal form method and center manifold theorem. Furthermore, with the help of the Maximum Principle of Pontryagin, we design an optimal control strategy for the previous model to extend the region of stability and reduce the density of infected nodes in WSNs. Finally, we conduct extensive simulations to evaluate the proposed model. Numerical evidence shows that the dynamic characteristics of malware propagation in WSNs are closely related to the immune period of a recovered node and the rate constant for nodes becoming susceptible again after recovered. Besides, we obtain that the optimal control strategy effectively improves the performance of the networks.

Bifurcation analysis of a delay reaction–diffusion malware propagation model with feedback control

With the rapid development of network information technology, information networks security has become a very critical issue in our work and daily life. This paper attempts to develop a delay reaction–diffusion model with a state feedback controller to describe the process of malware propagation in mobile wireless sensor networks (MWSNs). By analyzing the stability and Hopf bifurcation, we show that the state feedback method can successfully be used to control unstable steady states or periodic oscillations. Moreover, formulas for determining the properties of the bifurcating periodic oscillations are derived by applying the normal form method and center manifold theorem. Finally, we conduct extensive simulations on large-scale MWSNs to evaluate the proposed model. Numerical evidences show that the linear term of the controller is enough to delay the onset of the Hopf bifurcation and the properties of the bifurcation can be regulated to achieve some desirable behaviors by choosing the appropriate higher terms of the controller. Furthermore, we obtain that the spatial–temporal dynamic characteristics of malware propagation are closely related to the rate constant for nodes leaving the infective class for recovered class and the mobile behavior of nodes.

Propagation model of smartphone worms based on semi-Markov process and social relationship graph

Smartphone applications are getting more and more popular and pervasive in our daily life, and are also attractive to malware writers due to their limited computing source and vulnerabilities. At the same time, we possess limited understanding of our opponents in cyberspace. In this paper, we investigate the propagation model of SMS/MMS-based worms through integrating semi-Markov process and social relationship graph. In our modeling, we use semi-Markov process to characterize state transition among mobile nodes, and hire social network theory, a missing element in many previous works, to enhance the proposed mobile malware propagation model. In order to evaluate the proposed models, we have developed a specific software, and collected a large scale real-world data for this purpose. The extensive experiments indicate that the proposed models and algorithms are effective and practical.

Stochastic filtering of a random Fibonacci sequence: Theory and applications

This paper conceives a stochastic filtering problem to estimate, from noisy measurements, the numbers of the random Fibonacci sequence. The dynamical system is amenable to an exact solution, being the convolution of Bernoullian and Gaussian variables, yielding a closed form for the equations of the filter. The derived optimal filter has exponential computational complexity, thus a suboptimal filter with affordable computational load is conceived. The stochastic filter performance is then evaluated with two applications: one of theoretical value and one for a more practical application. More precisely the first case study estimates the Viswanath constant from noisy measurements of the random Fibonacci sequence. It is shown how the filter performs well in estimating the Viswanath constant even if the noise is significantly increased. The second case study refers to a model of malware propagation in a computer network. In this case, it is assumed that there is a random rate for the infection, assuming that a finite time is needed before a computer is infected. A random generalized Fibonacci sequence fits well in this case. Additional applications are possible in view of the fact that several systems both in biology and economy are well represented by Fibonacci binary random trees.