2010
DOI: 10.1145/1811099.1811063
|View full text |Cite
|
Sign up to set email alerts
|

Detecting sources of computer viruses in networks

Abstract: We provide a systematic study of the problem of finding the source of a computer virus in a network. We model virus spreading in a network with a variant of the popular SIR model and then construct an estimator for the virus source. This estimator is based upon a novel combinatorial quantity which we term rumor centrality. We establish that this is an ML estimator for a class of graphs. We find the following surprising threshold phenomenon: on trees which grow faster than a line, the estimator always has non-t… Show more

Help me understand this report

Search citation statements

Order By: Relevance

Paper Sections

Select...

Citation Types

4
86
0

Year Published

2015
2015
2020
2020

Publication Types

Select...
3
3

Relationship

0
6

Authors

Journals

citations
Cited by 103 publications
(90 citation statements)
references
References 14 publications
4
86
0
Order By: Relevance
“…However, this is only feasible for small networks. Message-passing algorithms can approximate the marginals efficiently [12,[14][15][16], however these algorithms are model specific: for every M , one must invent new approximations, heuristic assumptions and analytic calculations.In contrast, the second class of methods works independent of the forward model [14,[17][18][19]. These presuppose that s should be approximately equidistant to all other nodes in C, and therefore, nodes with high "centrality" values should have a higher likelihood of being s. This assumption breaks down if the spread reaches "boundaries", or if the spread self-interacts (i.e.…”
mentioning
confidence: 99%
See 4 more Smart Citations
“…However, this is only feasible for small networks. Message-passing algorithms can approximate the marginals efficiently [12,[14][15][16], however these algorithms are model specific: for every M , one must invent new approximations, heuristic assumptions and analytic calculations.In contrast, the second class of methods works independent of the forward model [14,[17][18][19]. These presuppose that s should be approximately equidistant to all other nodes in C, and therefore, nodes with high "centrality" values should have a higher likelihood of being s. This assumption breaks down if the spread reaches "boundaries", or if the spread self-interacts (i.e.…”
mentioning
confidence: 99%
“…Presently, there are two approaches to identify s. The first uses probability marginals from Bayesian methods [12][13][14][15][16][17][18][19][20][21]. In some cases, it is possible to sample the state space using Monte Carlo simulations [13].…”
mentioning
confidence: 99%
See 3 more Smart Citations