On Modeling Malware Propagation in Interest-Based Overlapping Communities

Abstract

Interest-based communities, where users may have diversified interests and consequently cause communities overlapping, exist extensively in social networks. However, this will inevitably introduce more opportunities for malware spreading, whose propagation model is fundamentally different from that in currently widely-studied contact-based social networks. To address this issue, we firstly investigate the basic differences between interest-based communities and contact-based social networks. Then, the problem is formulated, and two malware propagation models in interest-based overlapping communities are put forward, one for early propagation stage and another for general propagation stage respectively. The proposed models fully consider the characters of such environment and reveal the malware spreading rules of different propagation stages in randomly overlapping interest communities. Moreover, the models are transformed into lightweight computational complexity modes so as to be easily utilized in practice. Finally, our models are verified with simulations which are based on a real-world dataset from YouTube interest communities, showing the analytical results match the simulation results very well. INDEX TERMS Malware propagation, Interest-based communities, overlapping communities, immunity.

A Mobility-Based Epidemic Model for IoT Malware Spread

“…Link type Mobility Malware type Infection timing SI [9], [26], SIS [12], [27], SIR [15], [25], [28], SISV [29], SDIR [19], SEIRS [7], [18], SCIRAS [30], SEIQVS [31]…”

“…Epidemic models are primarily derived from states such as susceptible (S), infected (I), exposed (E), vaccinated (V), quarantined (Q), recovered (R), and dead (D). The typical models are SIS [11]- [14], SI [8]- [10], and SIR [15]- [17]. As discussed below, these traditional models, alongside other advanced ones with many states, have been extensively used to study the spread of malware.…”

“…Authors in [12] suggest that there is a relationship between the sender and the receiver, and thus the links between the nodes are bidirectional and have the same infection rate. SIR propagation model is studied in [15], [25]. Wei et al [15] considered interest-based communities where nodes with similar interests connect.…”

“…SIR propagation model is studied in [15], [25]. Wei et al [15] considered interest-based communities where nodes with similar interests connect. This form of connection forms multi-layered complex networks conducive to malware propagation.…”

“…Typically, we apply epidemic theory to model IoT malware diffusion in both wired and wireless networks since malware propagation can be likened to the spread of pathogens in humans [7]. In particular, Susceptible-Infectious (SI) [8]- [10], Susceptible-Infectious-Susceptible (SIS) [11]- [14], and Susceptible-Infectious-Recovered (SIR) [15]- [17] models are widely applied. Many variants such as Susceptible-Exposed-Infected-Recovered (SEIR) [18]- [20], Susceptible-Active-Dormant-Immune (SADI) [21], and Heterogeneous-Susceptible-Infected-Recovered-Dead (HSIRD) [22] are developed by introducing additional states and their corresponding parameters.…”