Malware Propagation Research Articles

Containing Viral Spread on Sparse Random Graphs: Bounds, Algorithms, and Experiments

Viral spread on large graphs has many real-life applications such as malware propagation in computer networks and rumor (or misinformation) spread in Twitter-like online social networks. Although viral spread on large graphs has been intensively analyzed on classical models such as Susceptible–Infectious–Recovered, there still exits a deficit of effective methods in practice to contain epidemic spread once it passes a critical threshold. Against this backdrop, we explore methods of containing viral spread in large networks with the focus on sparse random networks. The viral containment strategy is to partition a large network into small components and then to ensure that all messages delivered across different components are free of infection. With such a defense mechanism in place, an epidemic spread starting from any node is limited to only those nodes belonging to the same component as the initial infection node. We establish both lower and upper bounds on the costs of inspecting intercomponent messages. We further propose heuristic-based approaches to partitioning large input graphs into small components. Finally, we study the performance of our proposed algorithms under different network topologies and different edge-weight models.

Reaction-diffusion modeling of malware propagation in mobile wireless sensor networks

Mobile Wireless Sensor Networks (MWSNs) are employed in many fields, such as intelligent transportation, community health monitoring, and animal behavior monitoring. However, MWSNs may be vulnerable to malicious interference because of the large-scale characteristics. One of the threats is to inject malware into some nodes, especially mobile nodes. When a contaminated node communicates with its neighbors, multiple copies of the malware are transmitted to its neighbors, which may destroy nodes, block regular communications, or even damage the integrity of regular data packets. This work develops a modeling framework which mathematically characterizes the process of malware propagation in MWSNs based on the theory of reaction-diffusion equation. Our proposed model can efficiently predict the temporal dynamic behavior and spatial distribution of malware propagation over time, so that targeted immunization measures can be taken on infected nodes, whereas most of the existing models for malware propagation can only predict the temporal dynamic behavior rather than the spatial distribution of malware propagation over time. We conduct extensive simulations on large-scale MWSNs to evaluate the proposed model. The simulation results indicate that the proposed model and method are efficient, and that the mobile speed, communication range, and packet transmission rate of nodes are the main factors affecting malware propagation in MWSNs.

Malware Risk Analysis on the Campus Network with Bayesian Belief Network

A security network management system is for providing clear guidelines on risk evaluation and assessment for enterprise networks. The threat and risk assessment is conducted to safeguard enterprise network services to maintain system confidentiality, integrity, and availability through effective control strategies. In this paper, based on our previous work in analyzing integrated information security management and malware propagation on the campus network through mathematical modelling, we proposed Bayesian Belief Network with inference level indicator to enable the decision maker to understand and provide appropriate mitigation decisions on the risks posed. We experimentally placed monitoring sensors on the campus network that gives the threat alert priority levels and magnitude on the vulnerable information assets. These methods will give a direction on the belief inferred due to malware prevalence on the information security assets for better understanding.

Dynamical analysis and control strategies on malware propagation model

A variable infection rate is more realistic to forecast dynamical behaviors of malware (malicious software) propagation. In this paper, we propose a time-delayed SIRS model by introducing temporal immunity and the variable infection rate. The basic reproductive number R0 which determines whether malware dies out is obtained. Furthermore, using time delay as a bifurcation parameter, some necessary and sufficient conditions ensuring Hopf bifurcation to occur for this model are derived. Finally, numerical simulations verify the correctness of theoretical results. Most important of all, we investigate the effect of the variable infection rate on the scale of malware prevalence and compare our model with stationary analytical model by simulation. According to simulating results, some strategies that control malware rampant are given, which may be incorporated into cost-effective antivirus policies for organizations to work quite well in practice.

Influence of Removable Devices' Heterouse on the Propagation of Malware

The effects of removable devices’ heterouse in different areas on the propagation of malware spreading via removable devices remain unclear. As a result, in this paper, we present a model incorporating the heterogeneous use of removable devices, obtained by dividing the using rate into local area’s rate, neighbour area’s rate and global area’s rate, and then getting the final rate by multiplying the corresponding area ratio. The model’s equilibria and their stability conditions are obtained mathematically and verified by deterministic and stochastic simulations. Simulation results also indicate that the heterogeneity in using rate significantly changes the prospective propagation course of malware. Additionally, the thresholds of removable devices’ using rate in neighbour area are given, which can guide us in designing effective countermalware method.

Topological protection from the next generation malware: a survey

The spreading of dangerous malware in inter-dependent networks of electronics devices has raised deep concern, because from the ICT networks infections may propagate to other critical infrastructures producing the wellknown domino effect. Researchers are attempting to develop a high level analysis of malware propagation, discarding software details, in order to generalise to the maximum extent the defensive strategies. It has been suggested that the maximum eigenvalue could act as a threshold for the malware spreading. This paper presents a new proof of this statement and an original way to classify the max eigenvalue minimisation problem (NP-hard). A study of the Italian internet autonomous system verifying the theoretical threshold is shown. Finally, it shows how to stop a worm in a real LAN using a new sub-optimal algorithm. Such algorithm suggests which nodes to protect for limiting the worm diffusion according to the spectral paradigm.

A Survey on Malware Containment Models in Smartphones

Smartphones providing services like SMS/MMS, emails, online banking, and other applications, are becoming an integral part of our everyday lives. However, the availability of these services and applications provided by smartphones makes them a target for malicious attackers to propagate malware and perform other malicious attacks. To restrain malware propagation, the research advancement of malware containment is summarized in this paper. We provide an overview on malware, which includes the evolution of mobile malware, related concept, infection vectors, and risks. The typical malware containment models are selected to discuss in detail. At last, the current problems and challenges in this field for future work are proposed. This paper indicates that diversity and complexity of mobile malware pose great challenges in modeling malware containment.

A DISCRETE MATHEMATICAL MODEL TO SIMULATE MALWARE SPREADING

With the advent and worldwide development of Internet, the study and control of malware spreading has become very important. In this sense, some mathematical models to simulate malware propagation have been proposed in the scientific literature, and usually they are based on differential equations exploiting the similarities with mathematical epidemiology. The great majority of these models study the behavior of a particular type of malware called computer worms; indeed, to the best of our knowledge, no model has been proposed to simulate the spreading of a computer virus (the traditional type of malware which differs from computer worms in several aspects). In this sense, the purpose of this work is to introduce a new mathematical model not based on continuous mathematics tools but on discrete ones, to analyze and study the epidemic behavior of computer virus. Specifically, cellular automata are used in order to design such model.

What you see predicts what you get—lightweight agent‐based malware detection

ABSTRACTBecause of the always connected nature of mobile devices, as well as the unique interfaces they expose, such as short message service (SMS), multimedia messaging service (MMS), and Bluetooth, classes of mobile malware tend to propagate using means unseen in the desktop world. In this paper, we propose a lightweight malware detection system on mobile devices to detect, analyze, and predict malware propagating via SMS and MMS messages. We deploy agents in the form of hidden contacts on the device to capture messages sent from malicious applications. Once captured, messages can be further analyzed to identify a message signature as well as potentially a signature for the malicious application itself. By feeding the observed messages over time to a latent space model, the system can estimate the current dynamics and predict the future state of malware propagation within the mobility network. One distinct feature of our system is that it is lightweight and suitable for wide deployment. The system shows a good performance even when only 10% of mobile devices are equipped with three agents on each device. Moreover, the model is generic and independent of malware propagation schemes. We prototype the system on the Android platform in a universal mobile telecommunications system laboratory network to demonstrate the feasibility of deploying agents on mobile devices as well as collecting and blocking malware‐carrying messages within the mobility network. We also show that the proposed latent space model estimates the state of malware propagation accurately, regardless of the propagation scheme. Copyright © 2012 John Wiley & Sons, Ltd.

A Large-Scale Empirical Study of Conficker

Conficker is the most recent widespread, well-known worm/bot. According to several reports, it has infected about 7 million to 15 million hosts and the victims are still increasing even now. In this paper, we analyze Conficker infections at a large scale, about 25 million victims, and study various interesting aspects about this state-of-the-art malware. By analyzing Conficker, we intend to understand current and new trends in malware propagation, which could be very helpful in predicting future malware trends and providing insights for future malware defense. We observe that Conficker has some very different victim distribution patterns compared to many previous generation worms/botnets, suggesting that new malware spreading models and defense strategies are likely needed. We measure the potential power of Conficker to estimate its effects on the networks/hosts when it performs malicious operations. Furthermore, we intend to determine how well a reputation-based blacklisting approach can perform when faced with new malware threats such as Conficker. We cross-check several DNS blacklists and IP/AS reputation data from Dshield and FIRE and our evaluation shows that unlike a previous study which shows that a blacklist-based approach can detect most bots, these reputation-based approaches did relatively poorly for Conficker. This raises a question of how we can improve and complement existing reputation-based techniques to prepare for future malware defense? Based on this, we look into some insights for defenders. We show that neighborhood watch is a surprisingly effective approach in the case of Conficker. This suggests that security alert sharing/correlation (particularly among neighborhood networks) could be a promising approach and play a more important role for future malware defense.

PROGRAM DIFFERENTIATION

Mobile electronics are undergoing a convergence of what were formerly multiple single application devices into a single programmable device — generally a smart phone. The programmability of these devices increases their vulnerability to malicious attack. In this paper, we propose a new malware management system that seeks to use program differentiation to reduce the propagation of malware when a software vulnerability exists. By modifying aspects of the control flow of the application, we allow various portions of an application executable to be permuted into unique versions for each distributed instance. Differentiation is achieved using hardware and systems software modifications which are amenable to and scalable in embedded systems. Our initial areas for modification include function call/return and system call semantics, as well as a hardware-supported Instruction Register File. Differentiation of executables hinders analysis for vulnerabilities as well as prevents the exploitation of a vulnerability in a single distributed version from propagating to other instances of that application. Computational demands on any instance of the application are minimized, while the resources required to attack multiple systems grows with the number of systems attacked. By focusing on prevention of malware propagation in addition to traditional absolute defenses, we target the economics of malware in order to make attacks prohibitively expensive and infeasible.

The Early (tweet-ing) Bird Spreads the Worm: An Assessment of Twitter for Malware Propagation

Social Networks have rapidly become one of the most used Internet based applications. The structure and ease of information dissemination provides an opportunity for adversaries to use it for their own malicious purpose. In this paper we investigate a popular social network – Twitter as a malware propagation medium. We present a basic model for Twitter-based malware propagation using epidemic theory. Our analysis shows that even with a low degree of connectivity and a low probability of clicking links, Twitter and its structure can be exploited to infect many nodes.

Modeling Passive Propagation of Malwares on the WWW

Abstract Web-based malwares host in websites fixedly and download onto user's computers automatically while users browse. This passive propagation pattern is different from that of traditional viruses and worms. A propagation model based on reverse web graph is proposed. In this model, propagation of malwares is analyzed by means of random jump matrix which combines orderness and randomness of user browsing behaviors. Explanatory experiments, which has single or multiple propagation sources respectively, prove the validity of the model. Using this model, people can evaluate the hazardness of specified websites and take corresponding countermeasures.

Agent‐based modeling of malware dynamics in heterogeneous environments

ABSTRACTThe increasing convergence of power‐law networks such as social networking and peer‐to‐peer applications, web‐delivered applications, and mobile platforms makes today's users highly vulnerable to entirely new generations of malware that exploit vulnerabilities in web applications and mobile platforms for new infections, while using the power‐law connectivity for finding new victims. The traditional epidemic models based on assumptions of homogeneity, average‐degree distributions, and perfect‐mixing are inadequate to model this type of malware propagation. In this paper, we study four aspects crucial to modeling malware propagation: application‐level interactions among users of such networks, local network structure, user mobility, and network coordination of malware such as botnets. Since closed‐form solutions of malware propagation considering these aspects are difficult to obtain, we describe an open‐source, flexible agent‐based emulation framework that can be used by malware researchers for studying today's complex malware. The framework, called Agent‐Based Malware Modeling (AMM), allows different applications, network structure, network coordination, and user mobility in either a geographic or a logical domain to study various infection and propagation scenarios. In addition to traditional worms and viruses, the framework also allows modeling network coordination of malware such as botnets. The majority of the parameters used in the framework can be derived from real‐life network traces collected from a network, and therefore, represent realistic malware propagation and infection scenarios. As representative examples, we examine two well‐known malware spreading mechanisms: (i) a malicious virus such as Cabir spreading among the subscribers of a cellular network using Bluetooth and (ii) a hybrid worm that exploit email and file‐sharing to infect users of a social network. In both cases, we identify the parameters most important to the spread of the epidemic based upon our extensive simulation results. Copyright © 2011 John Wiley & Sons, Ltd.

Maximum Damage Malware Attack in Mobile Wireless Networks

Malware attacks constitute a serious security risk that threatens to slow down the large-scale proliferation of wireless applications. As a first step toward thwarting this security threat, we seek to quantify the maximum damage inflicted on the system due to such outbreaks and identify the most vicious attacks. We represent the propagation of malware in a battery-constrained mobile wireless network by an epidemic model in which the worm can dynamically control the rate at which it kills the infected node and also the transmission ranges and/or the media scanning rates. At each moment of time, the worm at each node faces the following tradeoffs: 1) using larger transmission ranges and media scanning rates to accelerate its spread at the cost of exhausting the battery and thereby reducing the overall infection propagation rate in the long run; or 2) killing the node to inflict a large cost on the network, however at the expense of losing the chance of infecting more susceptible nodes at later times. We mathematically formulate the decision problems and utilize Pontryagin Maximum Principle from optimal control theory to quantify the damage that the malware can inflict on the network by deploying optimum decision rules. Next, we establish structural properties of the optimal strategy of the attacker over time. Specifically, we prove that it is optimal for the attacker to defer killing of the infective nodes in the propagation phase until reaching a certain time and then start the slaughter with maximum effort. We also show that in the optimal attack policy, the battery resources are used according to a decreasing function of time, i.e., most aggressively during the initial phase of the outbreak. Finally, our numerical investigations reveal a framework for identifying intelligent defense strategies that can limit the damage by appropriately selecting network parameters.

On Modeling Malware Propagation in Generalized Social Networks

A hybrid malware on smart phones can be propagated by both end-to-end messaging services via personal social communications and short-range wireless communication services via spatial social interactions. Inspired from epidemiology, we propose a novel differential equation-based model to analyze the mixed behaviors of delocalized infection and ripple-based propagation for the hybrid malware in generalized social networks consisting of personal and spatial social relations. Validated by simulations, our model serves as the very first analytical model successfully approximating the complicated propagation behaviors of the hybrid malware.

Understanding the behavior of malicious applications in social networks

The World Wide Web has evolved from a collection of static HTML pages to an assortment of Web 2.0 applications. Online social networking in particular is becoming more popular by the day since the establishment of SixDegrees in 1997. Millions of people use social networking web sites daily, such as Facebook, My-Space, Orkut, and LinkedIn. A side-effect of this growth is that possible exploits can turn OSNs into platforms for malicious and illegal activities, like DDoS attacks, privacy violations, disk compromise, and malware propagation. In this article we show that social networking web sites have the ideal properties to become attack platforms. We introduce a new term, antisocial networks, that refers to distributed systems based on social networking web sites which can be exploited to carry out network attacks. An adversary can take control of a visitor's session by remotely manipulating their browsers through legitimate web control functionality such as image-loading HTML tags, JavaScript instructions, and Java applets.

Markov Random Fields for Malware Propagation: The Case of Chain Networks

Epidemic and stochastic models have been employed for describing the dynamic behavior of malware outbreaks. However, most of them lack a holistic treatment of the problem. In this work, we model malware propagation as a Markov Random Field and employ Gibbs sampling for the analysis of the system. We demonstrate the proposed framework for the case of a chain network, a model often emerging in both wired and wireless multi-hop networks.

Malware propagation in scale-free networks for the nodes with different anti-attack abilities

Considering the nodes with different anti-attack abilities in scale-free networks，we investigated the probabilistic behaviors of malware propagation in scale-free complex networks. Using the cellular automata，we proposed a model of malware propagation in complex networks with the nodes having different anti-attack abilities. In particular，a vulnerability function related to node’s degree is firstly introduced into the model to describe the different anti-attack abilities of nodes. Then，the epidemic threshold and time evolution of malware propagation are investigated through analysis and simulation for the various vulnerability functions. The results show that different anti-attack abilities of nodes can produce significant effects on the behaviors of propagation. For example，different anti-attack abilities of nodes can change the value of epidemic propagation，and slow down the spreading speed of malware. Finally，it is pointed out that the vulnerability function is very important for adopting appropriate immunization strategies to control the malware propagation.

Wireless Malware Propagation: A Reality Check

The paper discusses the data security on wireless communications. In recent years, several authors began to work on the concept of security attacks against wireless communication protocols- in particular, the propagation of malware through them. It was fun to design covert attack devices and evaluate the Bluetooth user population's exposure to them. However, the latest "developments" on these threats are stepping progressively away from reality and into an abstract, academic world of their own, something that might be just as fun, but that should be brought back into perspective when assessing the actual risks related to these scenarios. The author presents two distinct examples, the wireless LAN contagion and Bluetooth epidemics. The author concludes that wireless and mobile security, and, in particular, worm propagation over wireless networks, is an interesting and novel concept. It challenges and thrills, creating appealing newspaper headlines along the way. However, it must be sure to check our models against reality, and after predicting threats that failed to materialize, it must be able to understand where it went wrong.