Epidemic state analysis of computers under malware attacks

Abstract

This paper presents a stochastic model of analyzing epidemic states of computers that are infected by malicious codes. The model is based on a finite-Markovian process. The methodology presented here is unique and simple to determine the state probabilities of susceptible populations in general. Although the emphasis is on a computer-based infection model, it can be applied to various types of epidemiology. The simple epidemic model [D. Daley, J. Gani, Epidemic Modeling, an Introduction, Cambridge University Press, Cambridge, UK, 1999.] has its limitations; it has only one state transition, which goes from susceptible to infected, and hence infected forever. This paper will show that the states are recurrent. A healthy but susceptible node can become infected by a virus, can then become a transmitter, and can also return to a healthy state. Efficient mitigation approaches and optimal system reliability depend on accurately determined parameters for failure-rate and repair-rate of attacked systems. The model presented here is useful in determining state transition dynamics for estimating infection and recovery rates of susceptible systems. Thus, our model can complement the existing worm propagation models for bias-corrections and fine-tuning of worm's dynamics. Another major contribution of this paper is to promote further studies in determining performance criteria regarding the costs of mitigation and the improved system availability. (C) 2008 Elsevier B.V. All rights reserved.