On Capturing Malware Dynamics in Mobile Power-Law Networks

The increasing convergence of power-law networks such as social networking and peer-to-peer sites, web applications and mobile platforms makes today’s users highly vulnerable to entirely new generations of malware that exploit vulnerabilities in web applications and mobile platforms for new infections, while using the power-law connectivity for finding new victims. The traditional epidemic models based on assumptions of homogeneity, averagedegree distributions, and perfect-mixing are inadequate to model this type of malware propagation. In this paper, we study three aspects crucial to modeling malware propagation in such environments: application-level interactions among users of such networks, local network structure, and user mobility. Since closed-form solutions of malware propagation in such environments are difficult to obtain, we describe an open-source, flexible agent-based emulation framework that can be used by malware researchers for studying today’s complex malware. The framework, called Agent-Based Malware Modeling (AMM), allows different applications, network structure and user mobility in either a geographic or a logical domain to study various infection and propagation scenarios. The majority of the parameters used in the framework can be derived from real-life network traces collected from these networks, and therefore, represent realistic malware propagation and infection scenarios. As representative examples, we examine two well-known malware spreading mechanisms: (i) a malicious virus such as Cabir spreading among the subscribers of a cellular network using Bluetooth, and (ii) a hybrid worm that exploit email and file-sharing to infect users of a social network. In both cases, we identify the parameters most important to the spread of the epidemic based upon our extensive simulation results