Worm Propagation Model Research Articles

Internet epidemiology: healthy, susceptible, infected, quarantined, and recovered

AbstractThis paper presents a recurrent epidemic model (REM) to explore the dynamics of Internet epidemiology through the phases of susceptibility to recovery. From both theoretical and practical standpoint, it has two main differences compared to the bare worm propagation modeling. In the first place, it defines a unique stochastic model of a general infection spread. In the second place, it models the recovery process as a stochastic queueing system, which accurately partitions diagnose, quarantine, disinfection and recovery processes and complements it as a recurrent failure‐repair management model, which is entirely unique. There still exists an open question to model propagation patterns of infections and accompanying recovery models needed for effectively managing the infected individuals. The REM model is a unique concept in determining the parameters for estimating the recovery efficiency of disrupted systems and for developing long‐term recovery strategies under different epidemic situations. Existing infection and worm propagation models can also be used in cooperation with REM in order to analyse necessary quarantine and recovery processes. REM can also be applied for the accurate classification of the phases in epidemic dynamics and the states of affected systems in general, and also be used as a guideline for developing stochastic simulations covering various types of systems with recurrent state dynamics in order to facilitate reliability analysis of the systems. Copyright © 2011 John Wiley & Sons, Ltd.

Discrete-Time Simulation Method for Worm Propagation Model with Pulse Quarantine Strategy

In this paper, discrete-time simulation method for worm propagation model with pulse quarantine strategy is proposed. Such method is firstly applied to traditional Kermack-Mckendrick model and is verified to be effective. Then, considering practical factors, worm propagation model with pulse quarantine strategy is simulated in the method. Through the comparison between numerical curves and simulation ones, discrete-time simulation method can well simulate worm propagation under pulse quarantine strategy. Finally, the algorithm of the method is given and analyzed.

Modeling and analysis of Internet worm propagation

Although the frequency of Internet worm's outbreak is decreased during the past ten years, the impact of worm on people's privacy security and enterprise's efficiency is still a severe problem, especially the emergence of botnet. It is urgent to do more research about worm's propagation model and security defense. The well-known worm models, such as simple epidemic model (SEM) and two-factor model (TFM), take all the computers on the internet as the same, which is not accurate because of the existence of network address translation (NAT). In this paper, we first analyze the worm's functional structure, and then we propose a three layer worm model named three layres worm model (TLWM), which is an extension of SEM and TFM under NAT environment. We model the TLWM by using deterministic method as it is used in the TFM. The simulation results show that the number of NAT used on the Internet has effects on worm propagation, and the more the NAT used, the slower the worm spreads. So, the extensive use of NAT on the Internet can restrain the worm spread to some extent.

Modeling the propagation of Peer-to-Peer worms

Propagation of Peer-to-Peer (P2P) worms in the Internet is posing a serious challenge to network security research because of P2P worms’ increasing complexity and sophistication. Due to the complexity of the problem, no existing work has solved the problem of modeling the propagation of P2P worms, especially when quarantine of peers is enforced. This paper presents a study on modeling the propagation of P2P worms. It also presents our applications of the proposed approach in worm propagation research. Motivated by our aspiration to invent an easy-to-employ instrument for worm propagation research, the proposed approach models the propagation processes of P2P worms by difference equations of a logic matrix, which are essentially discrete-time deterministic propagation models of P2P worms. To the best of our knowledge, we are the first using a logic matrix in network security research in general and worm propagation modeling in particular. Our major contributions in this paper are firstly, we propose a novel logic matrix approach to modeling the propagation of P2P worms under three different conditions; secondly, we find the impacts of two different topologies on a P2P worm’s attack performance; thirdly, we find the impacts of the network-related characteristics on a P2P worm’s attack performance in structured P2P networks; and fourthly, we find the impacts of the two different quarantine tactics on the propagation characteristics of P2P worms in unstructured P2P networks. The approach’s ease of employment, which is demonstrated by its applications in our simulation experiments, makes it an attractive instrument to conduct worm propagation research.

Bifurcation analysis of a model for network worm propagation with time delay

In this paper, considering that reassembly of a system and/or using anti-virus software will take a period of time, we introduce a time delay for modeling this period of time. Also, considering that at different times the propagation of a worm shows different characteristics, we build a section model for Internet worm propagation depending on a two-factor model. We first consider the stability of the positive equilibrium and the existence of a local Hopf bifurcation. In succession, using the normal form theory and center manifold argument, we derive explicit formulas determining the stability, direction and other properties of bifurcation periodic solutions. Finally, a numerical simulation is presented. The techniques of analysis of the mathematical model provide a theoretical foundation for control and forecasting for Internet worms.

Proactive worm propagation modeling and analysis in unstructured peer-to-peer networks

It is universally acknowledged by network security experts that proactive peer-to-peer (P2P) worms may soon engender serious threats to the Internet infrastructures. These latent threats stimulate activities of modeling and analysis of the proactive P2P worm propagation. Based on the classical two-factor model, in this paper, we propose a novel proactive worm propagation model in unstructured P2P networks (called the four-factor model) by considering four factors: (1) network topology, (2) countermeasures taken by Internet service providers (ISPs) and users, (3) configuration diversity of nodes in the P2P network, and (4) attack and defense strategies. Simulations and experiments show that proactive P2P worms can be slowed down by two ways: improvement of the configuration diversity of the P2P network and using powerful rules to reinforce the most connected nodes from being compromised. The four-factor model provides a better description and prediction of the proactive P2P worm propagation.

Passive Benign Worm Propagation Modeling with Dynamic Quarantine Defense

Worm attacks can greatly distort network performance, and countering infections can exact a heavy toll on economic and technical resources. Worm modeling helps us to better understand the spread and propagation of worms through a network, and combining effective types of mitigation techniques helps prevent and mitigate the effects of worm attacks. In this paper, we propose a mathematical model which combines both dynamic quarantine and passive benign worms. This Passive Worm Dynamic Quarantine (PWDQ) model departs from previous models in that infected hosts will be recovered either by passive benign worms or quarantine measure. Computer simulation shows that the performance of our proposed model is significantly better than existing models, in terms of decreasing the number of infectious hosts and reducing the worm propagation speed.

Analysis of a scanning model of worm propagation

The traditional approach to modeling of internet worm propagation is to adopt a mathematical model, usually inspired by modeling of the spread of infectious diseases, describing the expected number of hosts infected as a function of the time since the start of infection. The predictions of such a model are then used to evaluate, improve, or develop defense and containment strategies against worms. However, a proper and complete understanding of worm propagation goes well beyond the mathematical formula given by the chosen model for the expected number of hosts infected at a given time. Thus, questions such as fitting the model, assessing the extent to which a specific realization of a worm spread may differ from the model’s predictions, behavior of the time points at which infections occur, and the estimation and effects of misspecification of model’s parameters must also be considered. In this paper, we address such questions for the well-known random constant spread (RCS) model of worm propagation. We first generalize the RCS model to our nonhomogeneous random scanning (NHRS) model. The NHRS model allows the worm’s contact rate to vary during worm propagation and it thus captures far more situations of interest than the RCS model which assumes a scanning rate constant in time. We consider the problem of fitting these models to empirical data and give a simulation procedure for a RCS epidemic. We also show how to obtain a confidence interval for the unknown contact rate in the RCS model. In addition, the use of prior information about the contact rate is discussed. The results and methodologies of this paper illuminate the structure and application of NHRS and RCS models of worm propagation.

Treating scalability and modelling human countermeasures against local preference worms via gradient models

A network worm is a specific type of malicious software that self propagates by exploiting application vulnerabilities in network-connected systems. Worm propagation models are mathematical models that attempt to capture the propagation dynamics of scanning worms as a means to understand their behaviour. It turns out that the emerged scalability in worm propagation plays an important role in order to describe the propagation in a realistic way. On the other hand human-based countermeasures also drastically affect the propagation in time and space. This work elaborates on a recent propagation model (Avlonitis et al. in J Comput Virol 3, 87–92, 2007) that makes use of Partial Differential Equations in order to treat correctly scalability and non-uniform behaviour (e.g., local preference worms). The aforementioned gradient model is extended in order to take into account human-based countermeasures that influence the propagation of local-preference worms in the Internet. Certain aspects of scalability emerged in random and local preference strategies are also discussed by means of random field considerations. As a result the size of a critical network that needs to be studied in order to describe the global propagation of a scanning worm is estimated. Finally, we present simulation results that validate the proposed analytical results and demonstrate the higher propagation rate of local preference worms compared with random scanning worms.

Commwarrior worm propagation model for smart phone networks

Commwarrior worm is capable of spreading through both Bluetooth and multimedia messaging service (MMS) in smart phone networks. According to the propagation characteristics of Bluetooth and MMS, we built the susceptible- exposed-infected-recovered-dormancy (SEIRD) model for the Bluetooth and MMS hybrid spread mode and performed the stability analysis. The simulation results show good correlation with our theoretical analysis and demonstrate the effectiveness of this dynamic propagation model. On the basis of the SEIRD model, we further discuss at length the influence of the propagation parameters such as user gather density in groups, moving velocity of smart phone, the time for worm to replicate itself, and other interrelated parameters on the propagation of the virus. On the basis of these analytical and simulation results, some feasible control strategies will be proposed to restrain the spread of mobile worm such as commwarrior on smart phone network.

Epidemic state analysis of computers under malware attacks

This paper presents a stochastic model of analyzing epidemic states of computers that are infected by malicious codes. The model is based on a finite-Markovian process. The methodology presented here is unique and simple to determine the state probabilities of susceptible populations in general. Although the emphasis is on a computer-based infection model, it can be applied to various types of epidemiology. The simple epidemic model [D. Daley, J. Gani, Epidemic Modeling, an Introduction, Cambridge University Press, Cambridge, UK, 1999.] has its limitations; it has only one state transition, which goes from susceptible to infected, and hence infected forever. This paper will show that the states are recurrent. A healthy but susceptible node can become infected by a virus, can then become a transmitter, and can also return to a healthy state. Efficient mitigation approaches and optimal system reliability depend on accurately determined parameters for failure-rate and repair-rate of attacked systems. The model presented here is useful in determining state transition dynamics for estimating infection and recovery rates of susceptible systems. Thus, our model can complement the existing worm propagation models for bias-corrections and fine-tuning of worm’s dynamics. Another major contribution of this paper is to promote further studies in determining performance criteria regarding the costs of mitigation and the improved system availability.

Internet worm early detection and response mechanism

In recent years, fast spreading worm has become one of the major threats to the security of the Internet and has an increasingly fierce tendency. In view of the insufficiency that based on Kalman filter worm detection algorithm is sensitive to interval, this article presents a new data collection plan and an improved worm early detection method which has some deferent intervals according to the epidemic worm propagation model, then proposes a worm response mechanism for slowing the wide and fast worm propagation effectively. Simulation results show that our methods are able to detect worms accurately and early.

A spatial stochastic model for worm propagation: scale effects

Realistic models for worm propagation in the Internet have become one of the major topics in the academic literature concerning network security. In this paper, we propose an evolution equation for worm propagation in a very small number of Internet hosts, hereinafter called a subnet and introduce a generalization of the classical epidemic model by including a second order spatial term which models subnet interactions. The corresponding gradient coefficient is a measure of the characteristic scale of interactions and as a result a novel scale approach for understanding the evolution of worm population in different scales, is considered. Results concerning random scan strategies and local preference scan worms are presented. A comparison of the proposed model with simulation results is also presented. Based on our model, more efficient monitoring strategies could be deployed.

Automated detection and containment of worms and viruses into heterogeneous networks: a simple network immune system

While much recent research concentrates on propagation models, the defence against worms is largely an open problem. Classical containment strategies, based on manual application of traffic filters, will be almost totally ineffective in the wide area since the worms are able to spread at rates that effectively preclude any human-directed reaction. Consequently, developing an automated, flexible and adaptive containment strategy is the most viable way to defeat worm propagation in an acceptable time. As a case in point, we look to natural immune systems, which solve a similar problem, but in a radically different way. Accordingly, we present a cooperative immunisation system inspired in principles and structure by the natural immune system that helps in defending against these types of attacks. Our system automatically detects pathologic traffic conditions due to an infection and informs, according to a cooperative communication principle, all the reachable networked nodes about the ongoing attack, triggering the actions required to their defence. To evaluate our proposal, we formulated a simple worm propagation and containment model, and evaluated our system using numerical solution and sensitivity analysis. Our measurements show that our reaction strategy is sufficiently robust against all the most common malicious agents. We envision that the above solution will be an effective line of defence against more aggressive worms.

Correlation Model of Worm Propagation on Scale-Free Networks

The problem of network worms is worsening despite increasing efforts and expenditure on cyber-security. Worm propagation is a random process that creates a complex system of interacting agents (worm copies) over the propagation medium – a scale-free graph, representing real-world networks. Understanding the propagation of network worms on scale-free graphs is the first step towards devising effective techniques for worm quarantining. After presenting the drawbacks of existing mean-field models, we develop a pair-approximation (correlation) model of worm propagation that employs the salient network characteristics – order, size, degree distribution, and transitivity. Inclusion of the transitivity shows significant improvement over existing pair-approximation models. The validity of the model is confirmed by comparing the numeric solution of the model to results from our individual-based simulation. Our model demonstrates that the network structure has considerable impact on the propagation dynamics when the worm uses local propagation strategies.

Using signal processing techniques to model worm propagation over wireless sensor networks

This paper describes how a topologically aware worm propagation model (TWPM) for wireless sensor networks is formulated and derived. The paper defines worm propagation characteristics that are specific to sensor networks. It also parameterize the effects of physical channel conditions, medium access control (MAC) layer contention, network layer routing, and transport layer protocol on worm propagation in sensor networks. The basic model formulation results in a partial differential equation, which is solved in the frequency domain to yield a closed-form solution for the TWPM. It is shown that in the spatial domain, the TWPM spread function is low-pass filtered by a two-dimensional isotropic Gaussian filter, thereby providing an intuitive feel for the dependence of the model on its underlying parameters. Simulation results demonstrate that the TWPM provides an effective and accurate worm propagation model for sensor networks