Influence of Removable Devices' Heterouse on the Propagation of Malware

Abstract

The effects of removable devices’ heterouse in different areas on the propagation of malware spreading via removable devices remain unclear. As a result, in this paper, we present a model incorporating the heterogeneous use of removable devices, obtained by dividing the using rate into local area’s rate, neighbour area’s rate and global area’s rate, and then getting the final rate by multiplying the corresponding area ratio. The model’s equilibria and their stability conditions are obtained mathematically and verified by deterministic and stochastic simulations. Simulation results also indicate that the heterogeneity in using rate significantly changes the prospective propagation course of malware. Additionally, the thresholds of removable devices’ using rate in neighbour area are given, which can guide us in designing effective countermalware method.

1. Introduction

The malicious programs or malware, including network worms, Trojan programs, and various botnets, have posed serious threats to the Internet [1–5]. Furthermore, removable devices have become a common propagation method by those recently detected malware, such as Stuxnet [6], Duqu [7], and Flame [8], which aim at controlling computers or other machinery, especially those physically isolated machines. Thus, it is very necessary to explore the propagation behavior and control strategies of such malware.

To capture the influences of removable devices on malware, some mathematical models have been proposed [9–13]. In [9], Song et al. presented the model by coupling a susceptible-infected-recovered (SIR) model with a susceptible-infected-susceptible (SIS) model [14]. In the model, a removable device would be infected with a certain rate if it was used on an infectious computer and then the infected removable device can infect other computers whenever it was used on them. To depict the computers which have been infected but are not yet infectious, Jin and Wang [10] put forward the susceptible-exposed-infected-recovered (SEIR) model by introducing the “exposed” state into the SIR model. L. X. Yang and X. Yang [11] further considered the model where the “exposed” state had limited infection ability. However, all of these models were homogeneous models. That is to say, each removable device was used with the same probability on all computers.

In [13], Peng et al. gave a model which divided the Internet into many subnets and assumed that removable devices were used equally within the subnet they belong to, but they were used with a lower probability outside the subnet. However, it is not a reasonable assumption that removable devices are homogeneously mixed with computers outside their subnet. Furthermore, under this assumption, they cannot give an effective defense method concerning removable devices’ using area and rate. Hence, we present a heterogeneous model in this paper, which can give an effective countermalware method by exploring the influences of removable devices’ using area and rate.

The remainder of this paper is organized as follows: we give the model and interpret the parameters’ meanings in Section 2. After that, we analyze its dynamical behavior and illustrate our mathematical results by simulations in Section 3. Then, some containment strategies are given in Section 4. In the end, we summarize our work.

2. The Model

The basic models used in this paper are the SIR model and the SIS model. There are five compartments in our model: susceptible computers (𝑆); infected computers (𝐼); immunized computers (𝑅); susceptible media (𝑀_𝑆)—removable devices without malicious programs; infected media (𝑀_𝐼)—removable devices which have carried the malicious programs and can propagate them to susceptible computers.

To depict the influences of removable devices’ using area and rate, we divide the whole area into many subareas and each removable device belongs to an area named the local area of the device. We also assume that removable devices are used equally within the local area and used with a lower probability in their neighbour areas but hardly used in any other areas named global area here.

Let 𝛽₁ be the susceptible computer’s infection rate caused by the successful scans of an infected computer. 𝛽₂ denotes susceptible computer’s infection rate (susceptible medium’s infection rate) due to an infected medium (an infected computer) in the same local area. 𝑁 and 𝑀 denote the total number of computers and the total number of removable devices, respectively. Here, we suppose that both 𝑁 and 𝑀 are constant. Then, the obsoleteness rate of computers (removable devices) is given by 𝜇₁ (𝜇₂).

To model the random discovery of infection by anti-virus program, the recovery rate of infected computers is given by 𝛿₁. When infected devices are used on susceptible or immunized computers, the malicious programs carried by infected devices are likely to be detected. We denote this rate by 𝛿₂.

Then, the model is given as follows: 𝑆̇=𝜇₁𝑁−𝛽₁𝑆𝐼2³²−𝐷(⋅)𝛽₂𝑆𝑀_𝐼𝑁−𝜇₁̇𝛽𝑆,𝐼=¹𝑆𝐼2³²+𝐷(⋅)𝛽₂𝑆𝑀_𝐼𝑁−𝛿₁𝐼−𝜇₁̇𝐼,𝑅=𝛿₁𝐼−𝜇₁𝑀̇𝑅,_𝑆=𝜇₂𝐷(⋅)𝛽𝑀−²𝑀_𝑆𝐼𝑁+𝛿₂𝑅+𝑆𝑁𝑀_𝐼−𝜇₂𝑀_𝑆,𝑀̇_𝐼=𝐷(⋅)𝛽₂𝑀_𝑆𝐼𝑁−𝛿₂𝑅+𝑆𝑁𝑀_𝐼−𝜇₂𝑀_𝐼, (1) where 𝐷(⋅) is the function of removable devices’ using area and rate. For all removable devices, let 𝛼₁(𝛼₂) denote the ratio of using rate in neighbour area (global area) to the counterpart in local area and let 𝜆₁(𝜆₂) be the ratio of neighbour area’s (global area’s) radius to local area’s radius. Without loss of generality, both removable devices’ using rate in local area and local area’s radius are set to 1. Then, 𝐷(⋅)=1𝜆²₂+𝛼₁𝜆²₁𝜆²₂+𝛼₂𝜆²₂−𝜆²₁−1𝜆²₂. (2)

As 𝑁=𝑆+𝐼+𝑅 and 𝑀=𝑀_𝑆+𝑀_𝐼, the model (1) can be rewritten as ̇𝛽𝐼=¹(𝑁−𝐼−𝑅)𝐼2³²+𝐷(⋅)𝛽₂(𝑁−𝐼−𝑅)𝑀_𝐼𝑁−𝛿₁𝐼−𝜇₁̇𝐼,𝑅=𝛿₁𝐼−𝜇₁𝑀̇𝑅,_𝐼=𝐷(⋅)𝛽₂𝑀−𝑀_𝐼𝐼𝑁−𝛿₂𝑁−𝐼𝑁𝑀_𝐼−𝜇₂𝑀_𝐼. (3)

Let 𝑅₀=𝛽₁𝑁2³²𝛿₁+𝜇₁+𝐷(⋅)²𝛽²₂𝑀𝛿₁+𝜇₁𝛿₂+𝜇₂𝑁, (4) where 𝑅₀ is the basic reproduction number [15].

For system (3), there are two equilibria: disease-free equilibrium 𝐸₀=(0,0,0) and positive equilibrium 𝐸^∗=(𝐼^∗,𝑅^∗,𝑀^∗_𝐼) when 𝑅₀>1. The positive equilibrium is given by 𝐼^∗=−𝑏+𝑏²−4𝑎𝑐,𝑅2𝑎_∗=𝛿₁𝜇₁𝐼^∗,𝑀^∗_𝐼=𝐷(⋅)𝛽₂𝑀𝐼^∗𝐷(⋅)𝛽₂−𝛿₂𝐼^∗+𝛿₂+𝜇₂𝑁, (5a)(5b)(5c)

where 𝑎=(𝛽₁(1+(𝛿₁/𝜇₁))(𝐷(⋅)𝛽₂−𝛿₂)𝑁)/2³², 𝑏=(𝛽₁(1+(𝛿₁/𝜇₁))(𝛿₂+𝜇₂)𝑁²)/2³²+(𝛿₁+𝜇₁)(𝐷(⋅)𝛽₂−𝛿₂)𝑁+𝐷(⋅)²𝛽²₂(1+(𝛿₁/𝜇₁))𝑀−(𝛽₁(𝐷(⋅)𝛽₂−𝛿₂)𝑁²)/2³², and 𝑐=(𝛿₁+𝜇₁)(𝛿₂+𝜇₂)𝑁²−(𝛽₁(𝛿₂+𝜇₂)𝑁³)/2³²−𝐷(⋅)²𝛽²₂𝑀𝑁.

3. Model Analysis

Theorem 1. If 𝑅₀<1, 𝐸₀ is asymptotically stable.

Proof. The characteristic equation of (3) at 𝐸₀ is given by 𝛽det𝜆−¹𝑁2³²−𝛿₁−𝜇₁0−𝐷(⋅)𝛽₂−𝛿₁𝜆+𝜇₁0−𝐷(⋅)𝛽₂𝑀𝑁0𝜆+𝛿₂+𝜇₂=0. (6)
Then, we have 𝜆+𝜇₁𝛽𝜆−¹𝑁2³²+𝛿₁+𝜇₁𝜆+𝛿₂+𝜇₂−𝐷(⋅)²𝛽²₂𝑀𝑁=0. (7)
When 𝑅₀<1, corresponding to (𝛿₁+𝜇₁−(𝛽₁𝑁)/2³²)(𝛿₂+𝜇₂)−(𝐷(⋅)²𝛽²₂𝑀)/𝑁>0, all eigenvalues of (7) have negative real parts. Thus, 𝐸₀ is asymptotically stable. The theorem is proven.

Theorem 2. If 𝑅₀>1, the endemic equilibrium 𝐸^∗ is asymptotically stable.

Proof. The characteristic equation of (3) at 𝐸^∗ is given by𝛽det𝜆−¹𝑁2³²+𝛽₁2𝐼^∗+𝑅^∗2³²𝛽₁𝐼^∗2³²+𝐷(⋅)𝛽₂𝑀^∗_𝐼𝑁−𝐷(⋅)𝛽₂𝑁−𝐼^∗−𝑅^∗𝑁+𝐷(⋅)𝛽₂𝑀^∗_𝐼𝑁+𝛿₁+𝜇₁−𝛿₁𝜆+𝜇₁0−𝐷(⋅)𝛽₂𝑀−𝑀^∗_𝐼𝑁−𝛿₂𝑀^∗_𝐼𝑁𝐷(⋅)𝛽0𝜆+²𝐼^∗𝑁+𝛿₂𝑁−𝐼^∗𝑁+𝜇₂=0, (8)
corresponding to 𝜆³+𝑎₁₁+𝑎₂₂+𝑎₃₃𝜆²+𝑎₁₁𝑎₂₂+𝑎₁₁𝑎₃₃+𝑎₂₂𝑎₃₃−𝑎₁₂𝑎₂₁−𝑎₁₃𝑎₃₁𝜆+𝑎₁₁𝑎₂₂𝑎₃₃−𝑎₁₂𝑎₂₁𝑎₃₃−𝑎₁₃𝑎₃₁𝑎₂₂=0, (9) where 𝑎₁₁=−(𝛽₁𝑁)/2³²+(𝛽₁(2𝐼^∗+𝑅^∗))/2³²+(𝐷(⋅)𝛽₂𝑀^∗_𝐼)/𝑁+𝛿₁+𝜇₁, 𝑎₁₂=(𝛽₁𝐼^∗)/2³²+(𝐷(⋅)𝛽₂𝑀^∗_𝐼)/𝑁, 𝑎₁₃=−(𝐷(⋅)𝛽₂(𝑁−𝐼^∗−𝑅^∗))/𝑁, 𝑎₂₁=−𝛿₁, 𝑎₂₂=𝜇₁, 𝑎₃₁=−(𝐷(⋅)𝛽₂(𝑀−𝑀^∗_𝐼))/𝑁−(𝛿₂𝑀^∗_𝐼)/𝑁, and 𝑎₃₃=(𝐷(⋅)𝛽₂𝐼^∗)/𝑁+𝛿₂(𝑁−𝐼^∗)/𝑁+𝜇₂.
According to the Hurwitz criteria [16, 17], we have 𝐻₁=𝑎₁₁+𝑎₂₂+𝑎₃₃=𝐷(⋅)𝛽₂𝑁−𝐼^∗−𝑅^∗𝑀^∗_𝐼𝑁𝐼^∗+𝛽₁𝐼^∗2³²+𝐷(⋅)𝛽₂𝑀^∗_𝐼𝑁+𝜇₁+𝐷(⋅)𝛽₂𝐼^∗𝑁+𝛿₂𝑁−𝐼^∗𝑁+𝜇₂,𝐻₂=𝑎²₁₁𝑎₂₂+𝑎²₁₁𝑎₃₃+𝑎₁₁𝑎²₂₂+𝑎²₂₂𝑎₃₃+𝑎₁₁𝑎²₃₃+𝑎₂₂𝑎²₃₃+2𝑎₁₁𝑎₂₂𝑎₃₃−𝑎₁₁𝑎₁₂𝑎₂₁−𝑎₁₁𝑎₁₃𝑎₃₁−𝑎₁₂𝑎₂₁𝑎₂₂−𝑎₁₃𝑎₃₁𝑎₃₃>𝑎₁₁𝑎₃₃−𝑎₁₃𝑎₃₁𝑎₁₁+𝑎₃₃>−𝛽₁𝑁−𝐼^∗−𝑅^∗2³²+𝛿₁+𝜇₁×𝛿₂𝑁−𝐼^∗𝑁+𝜇₂−𝐷(⋅)𝛽₂𝑁−𝐼^∗−𝑅^∗𝑁×𝐷(⋅)𝛽₂𝑀−𝑀^∗_𝐼𝑁+𝛿₂𝑀^∗_𝐼𝑁𝑎₁₁+𝑎₃₃=−𝛽₁𝑁−𝐼^∗−𝑅^∗𝐼^∗2³²+𝛿₁𝐼^∗+𝜇₁𝐼^∗−𝐷(⋅)𝛽₂𝑁−𝐼^∗−𝑅^∗𝑀^∗_𝐼𝑁𝛿₂𝑁−𝐼^∗𝑁𝐼^∗+𝜇₂𝐼^∗𝐻=0,₃=𝑎₁₁𝑎₂₂𝑎₃₃−𝑎₁₂𝑎₂₁𝑎₃₃−𝑎₁₃𝑎₃₁𝑎₂₂𝐻₂>𝑎₁₁𝑎₃₃−𝑎₁₃𝑎₃₁𝑎₂₂𝐻₂>0. (10)
If 𝑅₀>1, we have 𝐻₁>0,𝐻₂>0, and 𝐻₃>0 and then all eigenvalues of (9) have negative real parts. Thus, there exists an endemic equilibrium 𝐸^∗ and it is asymptotically stable when 𝑅₀>1. The proof is completed.

To validate the accuracy of Theorems 1 and 2, we used both deterministic method and stochastic method to simulate the system (3) with 𝑁=1000000, 𝑀=400000, 𝜇₁=𝜇₂=0.00046, and 𝛽₂=0.098 and two sets of other variables: (i) 𝛽₁=0.24, 𝛿₁=0.05, and 𝛿₂=0.05, where 𝑅₀≈5.98; (ii) 𝛽₁=0.05, 𝛿₁=0.1, and 𝛿₂=0.1, where 𝑅₀≈0.85.

As shown in Figure 1, when 𝑅₀>1, in both deterministic and stochastic simulations, the number of infected computers tends to the theoretical value predicted by (5a) finally, which indicates an endemic state 𝐸^∗. However, in Figure 2, when 𝑅₀<1, the steady-state number of 𝐼 is zero in accordance with the number predicted by disease-free state 𝐸₀.

Figure 1 

Fraction of infected computers when 𝑅0>1. (a) Blue (dash line): deterministic simulation; (b) black (solid line): theoretical value; (c) purple (dot-dash line): stochastic simulation.

Figure 2 

Fraction of infected computers when 𝑅0<1. (a) Blue (dash line): deterministic simulation; (b) black (solid line): theoretical value; (c) purple (dot-dash line): stochastic simulation.

4. Control Strategies

We first give the convergence proof of the numerical method, the improved Euler method, used in the simulation. Let 𝐈=(𝐼,𝑅,𝑀_𝐼). Then, we can rewrite the system (3) as 𝐈̇=𝐟(𝑡,𝐈). Obviously, 𝐟 is a continuous and differential function in 𝑅⁴. Thus, 𝐟 satisfies the Lipschitz condition and‖𝑓(𝑡,𝐈¹)−𝑓(𝑡,𝐈²)‖≤𝐿‖𝐈¹−𝐈²‖, where 𝐿 is a constant.

The Euler iteration equation is 𝐈^(𝑘+1)_𝑛+1=𝐈_𝑛+(ℎ/2)[𝐟(𝑡_𝑛,𝐈_𝑛)+𝐟(𝑡_𝑛+1,𝐈^(𝑘)_𝑛+1)] where 𝑘=0,1,2,…, 𝐈⁽⁰⁾_𝑛+1=𝐈_𝑛+ℎ𝐟(𝑡_𝑛,𝐈_𝑛) and 𝑛=0,1,2,…. ℎ=𝑡_𝑛+1−𝑡_𝑛, representing the step value in the Euler iteration algorithm. Then, we have 𝐈^(𝑘+1)_𝑛+1−𝐈^(𝑘)_𝑛+1=ℎ2𝐟𝑡_𝑛+1,𝐈^(𝑘)_𝑛+1−𝐟𝑡_𝑛+1,𝐈^(𝑘−1)_𝑛+1≤ℎ𝐿2𝐈^(𝑘)_𝑛+1−𝐈^(𝑘−1)_𝑛+1≤ℎ𝐿2²𝐈^(𝑘−1)_𝑛+1−𝐈^(𝑘−2)_𝑛+1≤≤⋯ℎ𝐿2^𝑘𝐈⁽¹⁾_𝑛+1−𝐈⁽⁰⁾_𝑛+1. (11) Thus, the numerical technique used here is convergent as we can ensure that ℎ𝐿/2<1 by selecting a small value of ℎ.

In this paper, we also use a Monte Carlo algorithm to simulate the propagation of malware [18, 19]. In all simulations given below, we set 𝑁=𝑀=1000000, 𝜇₁=𝜇₂=0.00046, 𝛽₁=0.06, 𝛽₂=2, 𝛿₁=0.06, 𝛿₂=0.033, 𝛼₂=0.0001, and 𝜆₂=32, where 𝛽₁≪𝛽₂ because that malware such as Stuxnet is mainly spreading via removable devices to infect physically isolated machines. The initial numbers of 𝐼 and 𝑀_𝐼 are set to 1000 and 0, respectively.

First, we compared three different models with the same parameters: homogeneous model presented in [9] where removable devices are assumed to be used with the same probability on all computers; heterogeneous model presented in [13] where the using rate of removable devices is divided into two rates (using rate on local computers and using rate on the other computers); and the model in this paper. We ran the simulation 100 times and got the average number of infected computers. Figure 3 shows the simulation results.

Figure 3 

Fraction of infected computers based on the model in this paper (blue, heterogeneous model where three areas divided according to the removable device’s using rate are considered) compared to the counterparts based on the model presented in [9] (green, homogeneous model) and in [13] (red, heterogeneous model where two areas are considered).

As shown in Figure 3, the model in this paper leads to the lowest infection rate and propagation speed. As it is established under the most reasonable assumptions among three models, its prediction is in accordance with the real propagation process to the most degree. The homogeneous model obtains the highest infection rate and the fastest propagation speed. Although the heterogeneity in removable devices’ using rate is included in the model given in [13], this simplistic division of removable devices’ using rate also leads to a great deviation.

We also simulated various 𝛼₁ and 𝜆₁ to gain some insight into the containment of the malware considered in this paper. Figures 4(a) and 4(b) give the simulation results with fixed 𝜆₁ and fixed 𝛼₁, respectively.

(a)

(b)

Figure 4 

Fraction of infected computers based on model (3) with (a) 𝛼1=0.4 (blue), 0.2 (green), 0.05 (red), and 𝜆1=10; (b) 𝜆1=10 (blue), 8 (green), 6 (red), and 𝛼1=0.2. The other parameters are the same as in Figure 3.

Figures 4(a) and 4(b) show that the radius of neighbour area (𝜆₁) and the using rate (𝛼₁) in this area have great influences on the propagation of malware. The infection rate and speed decrease rapidly with the decrease of using rate (𝛼₁) or neighbour area’s radius (𝜆₁). In Figure 4(a) with fixed 𝜆₁(10), the malware dies out directly when 𝛼₁=0.05, which means an effective countermalware method.

To get the effective countermalware thresholds under various values of 𝜆₁, we further simulated the system (3) and got the values of 𝛼₁ below which the malware would die out. Figure 5 plots the simulation results.

Figure 5 

The relationship between 𝛼1 and 𝜆1 under the phase transition condition where 𝜇1=0.00046, 𝜇2=0.00046, 𝛽1=0.06, 𝛽2=2, 𝛿1=0.06, 𝛿2=0.033, 𝛼2=0.0001, and 𝜆2=32.

As it is shown in Figure 5, the points in left area can guarantee the extinction of malware. However, the malware can self perpetuate in the right area. The threshold of 𝛼₁ decreases with the increase of 𝜆₁ and this decrease is much faster in the area between two arrows (𝜆^∗₁<𝜆₁<5). Furthermore, when the radius of neighbour area is less than two times of the radius of local area, corresponding to 𝜆₁≤𝜆^∗₁ (=2), the malware will die out no matter what value 𝛼₁ is, which gives a promising countermalware threshold.

5. Conclusion

Recently, the researches concerning malware have focused on those pieces malware spreading via removable devices [9–13]. Different from these researches, we present a model with a detailed depiction of the heterogeneity in removable devices’ using rate. This consideration of heterogeneity can lead to an effective countermalware method by controlling the removable devices’ using rate in neighbour area. Furthermore, when 𝛼₁=𝛼₂=1, the model presented in this paper corresponds to the model given in [9, 12]; when 𝛼₁=𝛼₂<1, it corresponds to the model given in [13]. Thus, the model in this paper is a more general model and can depict the malware’s spreading process more precisely.

Mathematical analysis and stochastic simulations indicate that the dynamics are determined by the value of 𝑅₀. Simulation results have also shown that removable devices’ using rate and the radius of neighbour area have great influences on the dynamics of malware. Specifically, we have obtained the thresholds of removable devices’ using rate (𝛼₁) when different values of 𝜆₁ (the radius of neighbour area) are considered, which can guide us in designing effective countermalware method.

In the future, we plan to use real trace data to test our model, especially the special value of removable devices’ using area (𝜆^∗₁) and then get the most effective policy to help people in defending their devices and machines against malware.

Conflict of Interests

The authors declare that there is no conflict of interests regarding the publication of this paper.

Acknowledgment

This work is supported by the National Natural Science Foundation of China (61379125, 61379080 and 11201434), Program for Basic Research of Shan’xi province (2012011015-3).