Analysis of malware propagation behavior in Social Internet of Things

Abstract

Summary Social Internet of Things (SIoT) is an evolution of the Internet of Things, where objects interact socially with each other in the sense that they can independently establish new relationships, offer, or discover services, in order to accomplish their tasks with minimum involvement of the user. This additional convenience comes at the expense of higher risk of speeding up malware propagation through the dynamically created relationships. Because of the undesirable effects of malware (eg, disruption of device operation), it is essential to understand their spreading behavior in order to minimize their negative impacts. In this paper, we analyze malware propagation behavior in SIoT and investigate different parameters that influence spreading of malware. Toward that end, a simulator has been developed to simulate the spreading process of malware in SIoT. Many propagation scenarios were analyzed using the proposed simulator. Simulation results show that adding more relationships in the SIoT or increasing the number of owned objects per user has increased malware spreading rate. For example, the time to infect all objects is faster by 45% when objects communicate through four relationships compared with the case when objects communicate through only two relationships in SIoT. We also investigated ways to restrict the malware spreading. Results show that preventing objects from establishing dynamic social relationship slows down the infection by 40% compared with the next best scenario (ie, blocking co‐location relationships), which means more time for vendors to patch up their products.

A Novel Epidemic Model Base on Pulse Charging in Wireless Rechargeable Sensor Networks

“…Due to the rechargeable characteristic, the time of the charging behavior relative to the whole process of the spreading of malware [ 33 ] is short, and the charging behavior can be thought of as a pulse activity to some extent. The problem of malware spreading under pulse charging is different from that under continuous charging mode [ 34 ].…”

A Mobility-Based Epidemic Model for IoT Malware Spread

“…Typically, we apply epidemic theory to model IoT malware diffusion in both wired and wireless networks since malware propagation can be likened to the spread of pathogens in humans [7]. In particular, Susceptible-Infectious (SI) [8]- [10], Susceptible-Infectious-Susceptible (SIS) [11]- [14], and Susceptible-Infectious-Recovered (SIR) [15]- [17] models are widely applied. Many variants such as Susceptible-Exposed-Infected-Recovered (SEIR) [18]- [20], Susceptible-Active-Dormant-Immune (SADI) [21], and Heterogeneous-Susceptible-Infected-Recovered-Dead (HSIRD) [22] are developed by introducing additional states and their corresponding parameters.…”

“…Many variants such as Susceptible-Exposed-Infected-Recovered (SEIR) [18]- [20], Susceptible-Active-Dormant-Immune (SADI) [21], and Heterogeneous-Susceptible-Infected-Recovered-Dead (HSIRD) [22] are developed by introducing additional states and their corresponding parameters. By considering propagation via both INF and D2D transmission links [8], [13], [17], [21], the epidemic models become more complicated but better suited for modeling the spreading behavior of realistic IoT malware.…”

“…In particular, mobility causes a node's neighbor to change constantly, thus increasing nodes' contact rate. The effects of mobility on malware spread have been studied in [17], [21], [24]. Furthermore, in [17], [21], authors model malware diffusion via both D2D and INF transmission links.…”

“…The effects of mobility on malware spread have been studied in [17], [21], [24]. Furthermore, in [17], [21], authors model malware diffusion via both D2D and INF transmission links. However, unlike our proposed model, these studies assume that the infection spread only happens after a node has moved, thus failing to capture the spreading behavior during the movement.…”