High Performance Scalable and Expressive Modeling Environment to Study Mobile Malware in Large Dynamic Networks

Abstract

Advances in computing and communication technologies are blurring the distinction between today's PCs and mobile phones. With expected smart phones sales to skyrocket, lack of awareness regarding securing them, and access to personal and proprietary information, has resulted in the recent surge of mobile malware. In addition to using traditional social-engineering techniques such as email and file-sharing, malware unique to Bluetooth, Short Messaging Service (SMS) and Multimedia Messaging Service (MMS) messages are being used. Large scale simulations of malware on wireless networks have becomes important and studying them under realistic device deployments is important to obtain deep insights into their dynamics and devise ways to control them.In this dissertation, we present EpiNet: an individual-based scalable high-performance oriented modeling environment for simulating the spread of mobile malware over large, dynamic networks.EpiNet can be used to undertake comprehensive studies during both planning and response phase of a malware epidemic in present and future generation wireless networks. Scalability is an important design consideration and the current EpiNet implementation can scale to 3-5 million device networks and case studies show that large factorial designs on million device networks can be executed within a day on 100 node clusters. Beyond compute time, EpiNet has been designed for analysts to easily represent a range of interventions and evaluating their efficacy.The results indicate that Bluetooth malware with very low initial infection size will not result in a major wireless epidemic. The dynamics are dependent on the network structure and, activitybased mobility models or their variations can yield realistic spread dynamics. Early detection of the malware is extremely important in controlling the spread. Non-adaptive response strategies using static graph measures such as degree and betweenness are not effective. Device-based detection mechanisms provide a much better means to control the spread and only effective when detection occurs early on. Automatic signature generation can help in detecting newer strains of the malware and signature distributions through a central server results in better control of the spread. Centralized dissemination of patches are required to reach a large proportion of devices to be effective in slowing the spread. Non-adaptive dynamic graph measures such as vulnerability are found to be more effective.Our studies of SMS and hybrid malware show that SMS-only malware spread slightly faster than Bluetooth-only malware and do not spread to all devices. Hybrid malware spread orders of magnitude faster than either SMS-only or Bluetooth-only malware and can cause significant damage.Bluetooth-only malware spread faster than SMS-only malware in cases where density of devices in the proximity of an infected device is higher. Hybrid malware can be much more damaging than Bluetooth-only or SMS-only malware and we need mechanisms that can prevent such an outbreak.EpiNe...

Reasoning about mobile malware using high performance computing based population scale models

“…In light of these issues, we use a synthetic mobility and contact network model constructed using a first-principles based approach (Eubank et al 2004;Barrett et al 2009)-this involves detailed activity modeling in large urban regions, and will be referred to as ABM in the rest of the paper. This approach integrates over a dozen public and commercial datasets, and involves the following steps (see Barrett et al 2009;Channakeshava et al 2011;Channakeshava et al 2009 for more details): (i) Create a synthetic urban population using several databases from commercial and public sources, while preserving their privacy and maintaining statistical indistinguishability; (ii) Use activity templates of individuals to create the activity-based mobility models. This generates the social network for individuals using the US census, survey data and time-use surveys; (iii) Assign detailed route plans to individuals based on the locations where activities are performed and the road network that connects the locations; (iv) Construct detailed movement patterns using a cellular automata based micro-simulation for individuals over the transportation infrastructure; and (v) Construct the Bluetooth proximity network using a sub-location model.…”

“…EpiCure (Channakeshava et al 2011) builds on EpiNet, and is designed specifically to work on commodity cluster architectures. It runs extremely fast for realistic instances that involve: (i) large time-varying networks consisting of millions of heterogeneous individuals with time varying interaction neighborhoods, (ii) dynamic interactions between the propagation of the malware, individual behavior, and exogenous interventions, and (iii) large number of replicated runs necessary for statistically sound estimates of malware spread dynamics.…”

“…Internet or wireless epidemiology (Ma, Voelker, and Savage 2005;Kleinberg 2007) acknowledges this close relationship and aims to use mathematical and biological principles developed by epidemiologists to study We briefly recall our earlier work on developing synthetic populations, dynamic synthetic mobile networks and HPC-based modeling environment; see Eubank et al (2004), Barrett et al (2009), Channakeshava et al (2011), Channakeshava et al (2009) for details.…”

Virus propagation power of the dynamic network

“…It is found that the virus will break out if the market share of intelligent mobile devices exceeds a certain threshold [8]. Some method has been put forward to address the problem of mobile phone virus [9][10][11]. But the mobility of smart devices can greatly increase the speed of virus propagation even if most nodes in the network remain still.…”

Integrated Multi-Network Modeling Environment for Spectrum Management

“…In a similar work in [7], these inter-dependencies are further studied which show failures in one infrastructure are cascaded over to other infrastructures in non-intuitive ways. In [20], the network produced by Dymenson has been used for studying malware spread, and the impact of realistic network topologies. The diversity of these applications illustrates the power and flexibility of our approach.…”