4th International ICST Conference on Security and Privacy in Communication Networks

Research Article

On Capturing Malware Dynamics in Mobile Power-Law Networks

  • @INPROCEEDINGS{10.1145/1460877.1460893,
        author={Abhijit Bose and Kang G. Shin},
        title={On Capturing Malware Dynamics in Mobile Power-Law Networks},
        proceedings={4th International ICST Conference on Security and Privacy in Communication Networks},
        keywords={mobile viruses worms malware power-law networks social networking agent-based modeling},
  • Abhijit Bose
    Kang G. Shin
    Year: 2008
    On Capturing Malware Dynamics in Mobile Power-Law Networks
    DOI: 10.1145/1460877.1460893
Abhijit Bose1,*, Kang G. Shin2,*
  • 1: IBM T J Watson Research 19 Skyline Drive Hawthorne, NY 10532
  • 2: The University of Michigan Electrical Engineering and Computer Science Ann Arbor, MI 48105
*Contact email: bosea@us.ibm.com, kgshin@eecs.umich.edu


The increasing convergence of power-law networks such as social networking and peer-to-peer sites, web applications and mobile platforms makes today’s users highly vulnerable to entirely new generations of malware that exploit vulnerabilities in web applications and mobile platforms for new infections, while using the power-law connectivity for finding new victims. The traditional epidemic models based on assumptions of homogeneity, averagedegree distributions, and perfect-mixing are inadequate to model this type of malware propagation. In this paper, we study three aspects crucial to modeling malware propagation in such environments: application-level interactions among users of such networks, local network structure, and user mobility. Since closed-form solutions of malware propagation in such environments are difficult to obtain, we describe an open-source, flexible agent-based emulation framework that can be used by malware researchers for studying today’s complex malware. The framework, called Agent-Based Malware Modeling (AMM), allows different applications, network structure and user mobility in either a geographic or a logical domain to study various infection and propagation scenarios. The majority of the parameters used in the framework can be derived from real-life network traces collected from these networks, and therefore, represent realistic malware propagation and infection scenarios. As representative examples, we examine two well-known malware spreading mechanisms: (i) a malicious virus such as Cabir spreading among the subscribers of a cellular network using Bluetooth, and (ii) a hybrid worm that exploit email and file-sharing to infect users of a social network. In both cases, we identify the parameters most important to the spread of the epidemic based upon our extensive simulation results