EpiNet: a simulation framework to study the spread of malware in wireless networks

ABSTRACT

We describe a modeling framework to study the spread of malware over realistic wireless networks. We develop (i) methods for generating synthetic, yet realistic wireless networks using activity-based models of urban population mobility, and (ii) an interaction-based simulation framework to study the dynamics of worm propagation over wireless networks. We use the prototype framework to study how Bluetooth worms spread over realistic wireless networks. This required developing an abstract model of the Bluetooth worm and its within-host behavior.

As an illustration of the applicability of our framework, and the utility of activity-based models, we compare the dynamics of Bluetooth worm epidemics over realistic wireless networks and networks generated using random waypoint mobility models. We show that realistic wireless networks exhibit very different structural properties. Importantly, these differences have significant qualitative effect on spatial as well as temporal dynamics of worm propagation. Our results also demonstrate the importance of early detection to control the epidemic.

REFERENCES

• 1: The Network Simulator NS-2. http://www.isi.edu/nsnam/ns/.
• 2: UCBT: Bluetooth Extension for NS2 at University of Cincinnatti. http://www.ececs.uc.edu/cdmc/ucbt/.
• 3: Christopher L. Barrett , Keith R. Bisset , Stephen G. Eubank , Xizhou Feng , Madhav V. Marathe, EpiSimdemics: an efficient algorithm for simulating the spread of infectious disease over large realistic social networks, Proceedings of the 2008 ACM/IEEE conference on Supercomputing, November 15-21, 2008, Austin, Texas
• 4: R. J. Beckman, K. A. Baggerly, and M. D. McKay. Creating synthetic base-line populations. Transportation Research Part A --- Policy and Practice, 1996.
• 5: Christian Bettstetter, Smooth is better than sharp: a random mobility model for simulation of wireless networks, Proceedings of the 4th ACM international workshop on Modeling, analysis and simulation of wireless and mobile systems, p.19-27, July 2001, Rome, Italy [doi>10.1145/381591.381600]
• 6: J. L. Bowman and M. E. Ben-Akiva. Activity-based Disaggregate Travel Demand Model System with Activity Schedules. Transportation research. Part A, Policy and practice, 35A, 2001.
• 7: S. Eubank, H. Guclu, V. S. A. Kumar, M. V. Marathe, A. Srinivasan, Z. Toroczkai, and N. Wang. Modeling Disease Outbreaks in Realistic Urban Social Networks. Nature, 429:180--184, May 2004.
• 8: Stephen Eubank , V. S. Anil Kumar , Madhav V. Marathe , Aravind Srinivasan , Nan Wang, Structural and algorithmic aspects of massive social networks, Proceedings of the fifteenth annual ACM-SIAM symposium on Discrete algorithms, January 11-14, 2004, New Orleans, Louisiana
• 9: P. Ferrie, P. Szor, R. Stanev, and R. Mouritzen. Security Responses: Symbos.cabir. Symantec Corporation, June 2004.
• 10: Chris Fleizach , Michael Liljenstam , Per Johansson , Geoffrey M. Voelker , Andras Mehes, Can you infect me now?: malware propagation in mobile phone networks, Proceedings of the 2007 ACM workshop on Recurring malcode, November 02-02, 2007, Alexandria, Virginia, USA [doi>10.1145/1314389.1314402]
• 11: R. Kairer. Smartphones Showed Strong Growth in 2007, February 2008. http://www.palminfocenter.com/news/9617/smartphones-showed-strong-growth-in-2007.
• 12: J. O. Kephart and S. R. White. Directed-Graph Epidemiological Models of Computer Viruses. Research in Security and Privacy, 1991. Proceedings., 1991 IEEE Computer Society Symposium on, 00:343--359, May 1991.
• 13: Jeffrey O. Kephart , Steve R. White , David M. Chess, Computers and epidemiology, IEEE Spectrum, v.30 n.5, p.20-26, May 1993 [doi>10.1109/6.275061]
• 14: M. Lactaotao. Security Information: Virus Encyclopedia: Symbos comwar.a. Trend Micro Incorporated, March 2005.
• 15: James W. Mickens , Brian D. Noble, Modeling epidemic spreading in mobile environments, Proceedings of the 4th ACM workshop on Wireless security, September 02-02, 2005, Cologne, Germany [doi>10.1145/1080793.1080806]
• 16: Scalable Network Technologies. QualNet. http://www.scalable-networks.com/.
• 17: P. Speckman, K. Vaughn, and E. Pas. A Continuous Spatial Interaction Model: Application to Home-Work Travel in Portland, Oregon. Transportation Research Board 1997 Annual Meeting, 1997.
• 18: Jing Su , Kelvin K. W. Chan , Andrew G. Miklas , Kenneth Po , Ali Akhavan , Stefan Saroiu , Eyal de Lara , Ashvin Goel, A preliminary investigation of worm infections in a bluetooth environment, Proceedings of the 4th ACM workshop on Recurring malcode, November 03-03, 2006, Alexandria, Virginia, USA [doi>10.1145/1179542.1179545]
• 19: Guanhua Yan , Stephan Eidenbenz, Bluetooth Worms: Models, Dynamics, and Defense Implications, Proceedings of the 22nd Annual Computer Security Applications Conference, p.245-256, December 11-15, 2006 [doi>10.1109/ACSAC.2006.18]
• 20: Guanhua Yan , Stephan Eidenbenz, Modeling Propagation Dynamics of Bluetooth Worms, Proceedings of the 27th International Conference on Distributed Computing Systems, p.42, June 25-27, 2007 [doi>10.1109/ICDCS.2007.121]
• 21: Guanhua Yan , Hector D. Flores , Leticia Cuellar , Nicolas Hengartner , Stephan Eidenbenz , Vincent Vu, Bluetooth worm propagation: mobility pattern matters!, Proceedings of the 2nd ACM symposium on Information, computer and communications security, March 20-22, 2007, Singapore [doi>10.1145/1229285.1229294]
• 22: Cliff Changchun Zou , Weibo Gong , Don Towsley, Code red worm propagation modeling and analysis, Proceedings of the 9th ACM conference on Computer and communications security, November 18-22, 2002, Washington, DC, USA [doi>10.1145/586110.586130]

INDEX TERMS

Primary Classification:
  I. Computing Methodologies
  I.6 SIMULATION AND MODELING
      I.6.5 Model Development
          Subjects: Modeling methodologies

Additional Classification:
  I. Computing Methodologies
  I.6 SIMULATION AND MODELING
      I.6.8 Types of Simulation
          Subjects: Discrete event

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Invasive software (e.g., viruses, worms, Trojan horses)

Keywords:
Bluetooth, activity-based, malware, wireless epidemics