Simulating and Estimating the Effectiveness of Security Notification by ISP to Malware-Infected Users

Abstract

In recent years, malware-infected devices, such as Mirai, have been used to conduct impactful attacks like massive DDoS attacks. Internet Service Providers (ISPs) respond by sending security notifications to infected users, instructing them to remove the malware; however, there are no approaches to quantify or simulate the performance and effectiveness of the notification activities. In this paper, we propose a model of security notification by ISPs. In the proposed model, we simulate the security notification with composite parameters, indicating the nature of malware attacks such as persistence of malware, user response ratio, and notification efforts by ISPs, and then discuss their effectiveness. Moreover, we conduct a simulation based on the actual attack.

Mitigate: Toward Comprehensive Research and Development for Analyzing and Combating IoT Malware

“…The results fit well with the actual situation of notification reported in previous work [6] and we can conclude that our proposed simulation is sufficiently valid. Please refer to our work [7], [8] for more details. Malware is used as an important component of cyberattacks.…”