A Time-dependent SIS-model for Long-term Computer Worm Evolution

Conference paper (2016)

Authors

M. Märtens Network Architectures and Services -

H. Asghari Organisation & Governance -

M.J.G. van Eeten Organisation & Governance -

P.F.A. Van Mieghem Network Architectures and Services -

Research Group

Network Architectures and Services () (TU Delft)

Mathematical model Computational modeling Grippers DVD

To reference this document use:

http://resolver.tudelft.nl/uuid:02512534-831c-4d0a-ad67-b613094c85bc

More Info

expand_more

Published Date

2016

Language

English

Reuse Rights

Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.

Faculty

Electrical Engineering, Mathematics and Computer Science

Department

Quantum & Computer Engineering

Research Group

Network Architectures and Services

Abstract

Epidemic models like the SIS or SIR model enable us to describe simple spreading processes over networks but are often not sufficient to accurately capture more complex network dynamics as exhibited by sophisticated and malicious computer worms. Many of the common assumptions behind epidemic models do not necessary hold if the process under investigation spans big networks or large scales of time.We extend the standard SIS network model by dropping the assumption of a constant curing rate in favour of a time-dependent curing rate function, which enables us to reflect changes in the effectiveness of the active worm removal process over time. The resulting time-dependent mean-field SIS model allows us to study the evolution of the size of computer worm bot-nets. We exemplify the complete procedure, including data-processing, needed to obtain a reliable model on data from Conficker, an extremely resilient computer worm. Using empirical data obtained from the Conficker sinkhole, we fit long time periods of up to 6 years on multiple scales and different levels of noise. We end by reflecting on the limits of epidemic models in empirical analysis of malware threats.