infection functions for virus propagation in computer networks: an empirical study

TSINGHUA SCIENCE AND TECHNOLOGY ISSNll1007-0214ll18/18llpp669-676 Volume 14, Number 5, October 2009

Infection Functions for Virus Propagation in Computer Networks: An Empirical Study*

YUAN Hua ( ), WU Junjie ( )†, CHEN Guoqing ( )**

School of Economics and Management, Tsinghua University, Beijing 100084, China; † School of Economics and Management, Beihang University, Beijing 100191, China

Abstract: There has been an increasing amount of interest in modeling virus propagation in recent years.

However, the group-based infection mechanism of computer viruses is not well understood and the selec-

tion of infection function in virus propagation modeling has not been well studied. This paper describes a

point-to-group (P2G) infection mode to describe virus propagation in networks with information sharing

groups. Simulations compare the constant infection and I-type infection functions with the new E-type infec-

tion function in the small-world-network environment. The simulation results show that the E-type infection

function shows superior performances to that of the traditional I-type infection function in modeling the P2G

virus infection mechanism and the I-type infection function shows better performance in modeling the ran-

dom infection mechanism.

Key words: computer virus propagation; infection mode; point-to-group propagation; small-world-network

Introduction

In recent years, computer viruses have posed a major threat to the information security for business effec-tiveness and continuity[1]. For instance, the annual in-formation security reports from the Computer Security Institute (CSI)[2] show that viruses caused the biggest

nancial loss among all computer security incidents in industry. Therefore, there is a critical need to under-stand virus propagation in computer networks.

Research has shown that there are signi cant simi-larities between the infection processes of computer viruses and biological disease[3]. Thereby, there have been increasing efforts to adapt biological epidemic

models, such as susceptible-infective-susceptible (SIS) and susceptible-infective-recovered (SIR) to computer virus propagation in networks[4-8]. The well-known random infection mode and the bi-linear infection function have been widely used. However, since the spreading of computer viruses is most importantly due to the logic rather than the physical connectivity of the network nodes[9], virus attacks from infectious nodes to other group members are not random but de nite, so traditional random infection mechanisms cannot accu-rately characterize virus infections in computer net-works with information sharing groups.

This paper is based on a point-to-group (P2G) infec-tion mechanism for virus propagation in networks with information sharing groups. Since some “old” infec-tious nodes cannot efficiently infect other nodes, an E-type infection function is used to characterize the P2G mode. The E-type function differs from the tradi-tional I-type function by using parameter of E(t) which may vary for different virus infection mechanisms. To that end, extensive simulations were used to study the validity of various infection functions for different

Received: 2008-07-25; revised: 2009-05-06

* Supported partly by the National Natural Science Foundation ofChina (Nos. 70890080 and 70621061), the MOE Project of KeyResearch Institute of Humanities and Social Sciences at Universities(No. 07JJD630005), and Lan Tian Xin Xiu Award of Beihang Uni-versity (No. 221531)

** To whom correspondence should be addressed. E-mail: [email protected]; Tel: 86-10-62772940

Tsinghua Science and Technology, October 2009, 14(5): 669-676

670

virus infection modes. The results based on the small-world-network (SWN) structure show that for the P2G infection mode, the E-type infection function is superior to the I-type function while for the random infection mode, the I-type infection function has slightly better performance than the E-type function. Finally, neither the E-and nor the I-type functions per-form well near a system boundary.

1 Preliminaries

The literature includes many epidemiology-based models to model virus propagation in computer net-works, such as SIS and SIR. Recently, the latent period of some viruses inside network nodes has drawn the attention of many researchers leading to widespread use of the so-called susceptible-exposed-infectious- recovered (SEIR) model[10,11].

The SEIR model is very similar to the SIR model, but accounts for the fact that some viruses go through a latent period before the host becomes infectious. In SEIR, a node may experience four states during the virus propagation: the susceptible state (S), the ex-posed state (E), the infectious state (I), and the recov-ered state (R), as shown in Fig. 1. In state S, the node is healthy but can be infected by viruses. In state E, the node is infected but the virus has not yet been triggered. In state I, the virus has been triggered and the node is infectious. In state R, the node has recovered from the non-healthy status and has immunity.

Fig. 1 SEIR model

In Fig. 1, (t), , and are state transition parameters and μ is the node replacement rate. If μ>0, then the network is an open propagation environment. Other-wise, it is a closed network. N is the total number of nodes in the network. A mature network can be as-sumed to be roughly in equilibrium, which leads to the balance equation: S(t)+E(t)+I(t)+R(t)=N, where S(t), E(t), I(t), and R(t) denote the number of susceptible, exposed, infectious, and recovered nodes at time t respectively.

The force of infection, (t), is the essential rate at which susceptible nodes become infected which is de-termined by the virus infection mode. Most studies

have used the constant infection mode and the random infection mode.

The constant infection mode assumes that the infec-tion process is stable and susceptible nodes will be infected with a constant probability or proportion. Thus, (t) const. Let c (t) denote the constant infection

rate, then the number of S-state nodes infected per unit time is

SE(t) cS(t) (1) where SE is the number of nodes added to the E-state.

The constant infection mode has been widely used[12-14], especially in studies of network virus prevalence with stochastic methods. Equation (1) is also known as the linear infection function.

The random infection mode assumes that every in-fectious node in the network infects its nearest neighbors, if susceptible, with a pre-de ned probability per neighbor. The general infection process assumes node i is susceptible and has ki neighbors, out of which ki

* are infected, then, node i will become infected with probability ki

*/ki. Accordingly, (t) can be approxi-mated by I I(t)[11-15], which leads to

SE(t) = II(t)S(t) (2) where I is a constant. The function in Eq. (2) has been widely used in computer virus research.

However, there are some disadvantages of using the random infection mode for computer virus research. First, the random infection mode is directly borrowed from biological virus studies, which may not be suit-able for virus propagation in computer networks, since the spreading of biological viruses is by random physical contact of the hosts, while the spreading of network viruses is by the connectivity of the computer systems. This connectivity is not a physical contact but a kind of logical contact[9]. Furthermore, the transmis-sion of virus codes from infectious nodes to suscepti-ble nodes is not a random process but by de nite at-tacks in the computer networks. This leads to the P2G mode described below.

2 P2G Infection Mode and Infection Functions

2.1 P2G infection mode

Real-world information sharing networks often have a “point to group” structure where each shares

YUAN Hua ( ) et al. Infection Functions for Virus Propagation in Computer Networks …

671

information with the nodes in the same group. For example, many small groups form in companies around projects, within a department, or even as pri-vate social relationships. Members within a group fre-quently communicate with each other, so viruses are most likely propagating within a group rather than across different groups. This is called the P2G infec-tion mode[16,17], which is described in this and next subsections.

Figure 2a shows a sample information sharing group and the P2G infections. The P2G infection mode can have the so-called “ineffective infections”. As can be seen in Fig. 2b, in this small group, the central node which is in state I can only infect the three group members which are in state S. Infections to other group members already in the E, I or R states are ineffective. Generally speaking, each infectious node that has been infected for a long time should be surrounded by few S-state nodes. Thus possible effective infections must be due to “new” I-state nodes (denoted by Inew ), since more of their group members are still in state S.

(a) P2G mode (b) Ineffective infections

Fig. 2 P2G mode and ineffective infection

Let r denote the average number of information sharing groups (sub-networks). The Inew(t) infectious nodes can simultaneously infect their rInew(t) neighbor nodes. Assuming that the proportion of S-state nodes is approximately S(t)/N, then the average number of in-fected individuals transiting from S to E is

new( )SE ( ) S trI tN

(3)

Since rInew is approximately equal to E(t), the number of nodes transiting from S to E is then

( )SE [ ( )] S tr E tN

(4)

Let E = r/N, then Eq. (4) can be simpli ed as SE (t)= E E(t)S(t) (5)

where E is a constant which can be regarded as the average infection ratio of the virus propagation system.

The functions in Eqs. (2) and (5) are referred as the I-type and E-type infection function. The E-type function differs from the I-type function in the use of E(t) rather than I(t).

2.2 Selecting the right infection functions

The three types of infection functions are, the constant infection function in Eq. (1), the I-type infection func-tion in Eq. (2), and the E-type infection function in Eq. (5). The objective is to identify the function which best models the virus propagation process. The analysis is based on the three parameters c, I, and E as follows.

cSE( )

( )t

S t (6)

ISE( )( ) ( )

tS t I t

(7)

ESE( )

( ) ( )t

S t E t (8)

For viruses in real-world networks, c, I, and E are all expected to be constant. Thus, the stability of , where = c, I, or E, can be used to evaluate the

tness of the corresponding infection function in vari-ous real-world network environments.

Assume the stable virus propagation process begins at time t0 and ends at time tn. At each time ti (0 i n),

S(ti), E(ti), I(ti), and SE(ti) in the simulations are used to calculate ci, Ii, and Ei according to Eqs. (6), (7), and (8) giving the sequences:

{ c0, c1, ..., ci, ..., cn}, { I0, I1, ..., Ii, ..., In},

{ E0, E1, ..., Ei, ..., En} (9) Then, the standard deviations of the three time series

can be calculated with a smaller variation implying better modeling of that infection.

Zou et al.[18] found that a decreasing infection rate (t) modeled the Code Red worm propagation on the

Internet better than a constant rate, . The slowing worm propagation rate leads to a variable , which will not be discussed here since this research focuses on the classical fast propagation modes.

3 Simulation Setup

SWN often exists in real-world applications, thus the small-world structure was selected as the basic net-work topology for the simulations. Then, the virus in-fection mechanisms for the network nodes were then


672

based on the infection modes discussed in Section 2.

3.1 Setup of SWN

Watts and Strogatz[19] used SWN to translate the com-plex topology of social interactions into an abstract model. Generally, the term “small world network” re-fers to networks with a small number of shortcuts on a regular underlying lattice, introduced either by adding new links between randomly selected vertices or by randomly rewiring a fraction of the links. In terms of population mixing, a small-world structure is analo-gous to clusters of connected individuals (social groups) which have contacts with “nearby” groups as well as “far-off” groups via sparse long-range links. Small worlds may play an important role in the study of the in uence of the network structure on the dynamics of many processes, for example, computer virus propaga-tion in this paper.

The goal of this study is to simulate the spreading

dynamics of computer viruses in small-world-networks. The edge-adding method is used to construct the small-world networks[20,21] in two steps.

(1) Regular ring generation Start with an N-site one-dimensional ordered network with periodic boundary conditions, a ring, where each node is linked to its r nearest neighbors, i.e., to the r/2 nearest neighbors in both the clockwise and counterclockwise directions.

(2) Edge-adding Shortcuts are created by adding new edges. That is, for each edge (u, v), add a new edge (u, w) with probability p with a randomly-chosen existing node w. pNr/2 new edges are then added to the original regular ring. The parameter p measures the disorder or randomness of the resulting small-world network with a larger p indicating smoother connec-tions between the small-world groups.

Figure 3 shows some sample SWNs generated with different p values. Note that double and multiple links are forbidden.

Fig. 3 Small-world-networks with different p (N = 12, r = 4)

3.2 Virus infection mechanism

The mode in the network topology is then character-ized by:

node[id] {

string state; int groupVolume; long groupMember[128]; int stayTime.

} where “id” is the identi cation number, “state” denotes the current status of the node which can be one of {S, E, I, R}, and “groupVolume” denotes the total number of directly-connected neighbors of the node with the neighbors’ ids stored in vector groupMember. Finally, “stayTime” indicates the time for the node in the E-state or I-state.

The node de nition can be used for all types of virus infection modes. For the random infection mode, the

simulation system periodically searches each S-state node, nds its connected neighbors, and decides whether to trigger an infection with a probability equal to the proportion of I-state nodes among the neighbors. For the P2G infection mode, the system periodically scans each I-state node and immediately triggers infec-tions to its connected S-state neighbors.

4 Simulation Results 4.1 Parameter settings

The simulation parameters can be categorized as net-work structure parameters (NSP), state transition pa-rameters (STP), and initial parameters (IP), as shown in Table 1.

tE and tI are the two most important state-transition parameters. The time in E-state has a normal distribu-tion with a mean of 4 time units and a standard varia-tion of 2 time units. Similarly, the tI distribution is also normal with a mean of 12 time units and a standard


673

Table 1 Parameters used in simulations

Type Parameter Value Note N 10 000 Network volume r 30 Group volume NSP p 0.1, 0.5 or 0.9* Probability of added links tE 4† Time in E-state tI 12† Time in I-state STP 1/4380 or 0* Replacement rate

S(0) 9980 Number of initial S-state nodes E(0) 20 Number of initial E-state nodes I(0) 0 Number of initial I-state nodes

IP

R(0) 0 Number of initial R-state nodes

Note: † is the expected value; * is used for the comparison purpose.

variation of 4 time units. The two values for the re-placement parameter μ are 1/4380 which indicates an open network and 0 implies a closed network.

Moreover, the parameters assume that the simulation is in the initial stage of the virus propagation where most of the network nodes are healthy and do not resist the virus (S(0)=9980). Only a very small portion of the nodes are infected by the virus and currently in the latent period (E(0)=20).

Generally, the parameters are xed in all the simula-tions unless explicitly stated otherwise. These parame-ters were carefully chosen to better simulate real-world conditions.

4.2 Infection functions for P2G infection mode

The E-type and I-type infection functions were used to characterize the P2G infection mode with the standard deviation used to evaluate the stability of in the in-fection functions.

First consider open networks with μ=1/4380. Figure 4 shows the variation of E and I for E-type and I-type infections for various p. E and I were computed at each time using Eqs. (7) and (8). The fluctuations of I are much more severe than that of E during the virus propagation process regardless of p. Thus, for the P2G infection mode, the E-type infection function has better stability and is superior to the I-type infection function. Table 2 shows that the standard deviation of E is much less than that of I to support this conclusion.

Table 2 Standard deviations of E and I for the P2G mode for an open network

Standard deviation (×10 4) p

E I 0.1 0.22 1.43 0.5 4.82 8.53 0.9 5.73 10.68

Fig. 4 E and I series for the P2G mode for an open network

Figure 5 and Table 3 show the simulation results for the replacement parameter μ=0, which is a closed net-work. A similar trend is found with E being much more stable than I. Thus, the type of network does not affect the conclusion.


674

Fig. 5 E and I for the P2G mode for a closed network

Table 3 Standard deviation of E and I for the P2G mode for a closed network


E I 0.1 0.26 1.01 0.5 2.16 3.75 0.9 7.69 15.74

Thus, the E-type infection function is indeed more suitable for characterizing the virus propagation proc-ess in the P2G mode.

4.3 Infection functions for the random infection mode

In the random infection mode, however, the situations are quite different. Figure 6 shows the simulation re-sults for the open network environment where the

uctuations of E are similar to these of I. However, E trends upward during the virus propagation process,

which implies that E is not stable for the random in-fection mode.

Fig. 6 E and I for the random mode for an open network

The standard deviations of E and I in Table 4 show that for SWNs with p=0.5 or p=0.9, the standard de-viation of E is larger than that of I while for p=0.1 E and I are comparable.

Table 4 Standard deviation of E and I for the ran-dom mode in an open network


E I 0.1 1.81 1.84 0.5 2.74 1.81 0.9 3.12 2.00

The simulation results for the random mode in a closed network (μ=0) are similar to the open network case. In summary, the E-type infection function is not


675

always superior to the I-type function. For the P2G mode, the E-type is more suitable while for the tradi-tional random infection mode, the I-type infection function is more suitable.

4.4 Unsuitability of the constant infection function

The performance of the constant infection mode for characterizing the virus propagation was also evaluated in simulation.

As can be seen in Fig. 7, c is very volatile in both the open and closed networks for both types of infec-tion modes. The standard deviations of c shown in Table 5 are much higher than those of E and I pre-sented previously. This implies that c is unsuitable for modeling of virus propagation in real-world applications.

Table 5 Standard deviations of c for the both modes and open and closed networks

Standard deviations of c (×10 4) p

P2G-Open P2G-Closed Random-Open Random-Closed0.1 988.5 1891.2 42.7 42.1 0.5 9340.9 7186.1 168.7 180.7 0.9 15 057.5 30 690.8 208.2 222.6

4.5 Discussion

The simulations shows that: (1) the constant infection function is unsuitable for modeling virus propagation in real computer networks; (2) for the P2G infection mode, the E-type infection function is superior to the I-type function; and (3) for the random infection mode, the I-type infection function is better than the E-type function.

The exact reasons for these conclusions are difficult to identify, since the simulations are very complex. The concept of the “ineffective infection” helps partially explain the results. The virus propagation in the P2G mode is much faster and widespread than in the ran-dom mode. Thus, the effect of ineffective infections of the “old” I-state nodes tends to be more prominent in the P2G mode and the E-type infection function per-forms better in the P2G mode. The random mode, however, has far fewer ineffective infections due to the much slower virus propagation. The E-type infection function then may exaggerate the impact of the inef-fective infections resulting in worse performance.

Both infection functions may encounter problems at the system boundary. For instance, near the end of the

Fig. 7 c series in (a) P2G infection mode in an open network; (b) P2G infection mode in a closed network; (c) random infection mode in an open network; and (d) random infection mode in a closed network

virus propagation process, E and I uctuated more. Therefore, the current conclusions are based on simu-lation results well inside the system boundaries.


676

5 Conclusions

This study uses a P2G infection mode to model virus infections in computer networks with information sharing groups. Simulations were used to compare various infection functions for different infection mechanisms. The results show that: (1) the constant infection function is unsuitable for modeling virus propagation in real computer networks; (2) for the P2G infection mode, the E-type infection function is supe-rior to the I-type function; (3) for the random infection mode, the I-type infection function is slightly better than the E-type function; and (4) both the E-type and I-type functions do not perform well at the system boundary.

References

[1] Thuraisingham B M, Clifton C, Gupta A, et al. Directions for web and e-commerce applications security. In: Pro-ceeding of Tenth IEEE International Workshops on Ena-bling Technologies: Infrastructure for Collaborative Enter-prises. Cambridge, MA, USA, 2001: 200-204.

[2] CSI/FBI. Computer crime and security survey, 2003, 2004. http://www.gocsi.com.

[3] Datta S, Wang H. The effectiveness of vaccinations on the spread of email-borne computer viruses. In: Proceeding of Canadian Conference on Electrical and Computer Engi-neering. Saskatoon, SK, Canada, 2005: 219-223.

[4] Kephart J O, White S R, Chess D M. Computers and epi-demiology. IEEE Spectrum, 1993, 30: 20-26.

[5] Kephart J, White S. Measuring and modeling computer virus prevalence. In: IEEE Computer Security Symposium on Research in Security and Privacy. Oakland, California, USA, 1993: 2-15.

[6] Mishra B K, Jha N. Fixed period of temporary immunity after run of anti-malicious software on computer nodes. Applied Mathematics and Computation, 2007, 190(2): 1207-1212.

[7] Wierman J C. Probabilistic analysis of a computer virus epidemic model. In: Proceedings of the Workshop on Sta-tistical and Machine Learning Techniques in Computer In-trusion Detection. Baltimore, USA, 2002: 1-15.

[8] Zou C C, Gong W, Towsley D, et al. The monitoring and early detection of internet worms. IEEE/ACM Transactions on Networking, 2005, 13(5): 961-974.

[9] Kim J, Radhakrishnan S, Dhall S K. Measurement and analysis of worm propagation on internet network topology. In: Proceedings of 13th International Conference on Com-puter Communications and Networks. Chicago, IL, USA, 2004: 495-500.

[10] Wang Y, Wang C. Modeling the effects of timing parame-ters on virus propagation. In: The 2003 ACM Workshop on Rapid Malcode. Washington DC, USA, 2003: 61-66.

[11] Anderson R M, May R M. Infectious Diseases of Humans: Dynamics and Control. New York, USA: Oxford Univer-sity Press, 1992.

[12] Pastor-Satorras R, Vespignani A. Epidemics and Immuni-zation in Scale-Free Networks. Berlin, Germany: Wiley VCH, 2002: 113-132.

[13] Sehgal V K. Stochastic modeling of worm propagation in trusted networks. In: The 2006 International Conference on Security and Management. Las Vegas, USA, 2006: 26-29.

[14] Chakrabarti D, Wang Y, Wang C, et al. Epidemic thresh-olds in real networks. ACM Transactions on Information and System Security, 2008, 10(4): 1-26.

[15] Keeling M J, Eames K T D. Networks and epidemic mod-els. Journal of the Royal Society Interface, 2005, 2(4): 295-307.

[16] Yuan Hua, Chen Guoqing. Network virus-epidemic model with the point-to-group information propagation. Applied Mathematics and Computation, 2008, 206: 357-367.

[17] Yuan Hua, Chen Guoqing, Xiong Hui, et al. Towards con-trolling virus propagation in information systems with point-to-group information sharing. Decision Support Sys-tems, 2009 (doi:10.1016/j.dss.2009.05.014).

[18] Zou C C, Gong W, Towsley D. Code Red worm propaga-tion modeling and analysis. In: Proceeding of the 9th ACM Symposium on Computer and Communication Security. Washington, USA, 2002: 138-147.

[19] Watts D J, Strogatz S H. Collective dynamics of small-world networks. Nature, 1998, 393(6684): 440-442.

[20] Newman M E J, Watts D J. Renormalization group analysis of the small-world network model. Physics Letters A, 1999, 263(4-6): 341-346.

[21] Monasson R. Diffusion, localization and dispersion rela-tions on small-world lattices. The European Physical Journal B, 1999, 12(4): 555-567.

infection functions for virus propagation in computer networks: an empirical study

Documents