Skip to main content
SpringerLink
Log in

Cyber Network Resilience Against Self-Propagating Malware Attacks

  • Conference paper
  • First Online:
Computer Security – ESORICS 2022 (ESORICS 2022)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 13554))

Included in the following conference series:

Abstract

Self-propagating malware (SPM) has led to huge financial losses, major data breaches, and widespread service disruptions in recent years. In this paper, we explore the problem of developing cyber resilient systems capable of mitigating the spread of SPM attacks. We begin with an in-depth study of a well-known self-propagating malware, WannaCry, and present a compartmental model called SIIDR that accurately captures the behavior observed in real-world attack traces. Next, we investigate ten cyber defense techniques, including existing edge and node hardening strategies, as well as newly developed methods based on reconfiguring network communication (NodeSplit) and isolating communities. We evaluate all defense strategies in detail using six real-world communication graphs collected from a large retail network and compare their performance across a wide range of attacks and network topologies. We show that several of these defenses are able to efficiently reduce the spread of SPM attacks modeled with SIIDR. For instance, given a strong attack that infects 97% of nodes when no defense is employed, strategically securing a small number of nodes (0.08%) reduces the infection footprint in one of the networks down to 1%.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 79.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 99.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    The eigen-score of an edge \(e = (i, j)\) equals to the product of the i-th and j-th elements of the left and right eigenvectors corresponding to \(\lambda _1\), i.e. \(u(i) \times v(j)\).

  2. 2.

    Modularity is defined as the number of edges falling within groups minus the expected number in the null model of the network (i.e., an equivalent network with edges placed at random) [29].

  3. 3.

    https://www.newnettechnologies.com/study-finds-majority-of-port-vulnerabilities-are-found-in-three-ports.html.

References

  1. Akaike, H.: Information theory and an extension of the maximum likelihood principle. In: Parzen, E., Tanabe, K., Kitagawa, G. (eds.) Selected Papers of Hirotugu Akaike. Springer Series in Statistics. Springer, New York (1998). https://doi.org/10.1007/978-1-4612-1694-0_15

  2. Albert, R., Jeong, H., Barabási, A.L.: Error and attack tolerance of complex networks. Nature 406, 376–382 (2000)

    Article  Google Scholar 

  3. Alstott, J., Bullmore, E., Plenz, D.: Powerlaw: a python package for analysis of heavy-tailed distributions (2013). http://arxiv.org/abs/1305.0215

  4. Anjum, I., et al.: Removing the reliance on perimeters for security using network views. In: ACM SACMAT, pp. 151–162 (2022)

    Google Scholar 

  5. Baig, M.B., Akoglu, L.: Correlation of node importance measures: an empirical study through graph robustness. In: WWW, pp. 275–281 (2015)

    Google Scholar 

  6. Brauer, F.: Compartmental models in epidemiology. In: Mathematical Epidemiology. LNM, vol. 1945, pp. 19–79. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-78911-6_2

    Chapter  MATH  Google Scholar 

  7. Chakrabarti, D., Wang, Y., Wang, C., Leskovec, J., Faloutsos, C.: Epidemic thresholds in real networks. ACM Trans. Inf. Syst. Secur. 10(4), 1:1-1:26 (2008)

    Article  Google Scholar 

  8. Chan, H., Akoglu, L.: Optimizing network robustness by edge rewiring: a general framework. Data Min. Knowl. Discov. 30(5), 1395–1425 (2016). https://doi.org/10.1007/s10618-015-0447-5

    Article  MathSciNet  MATH  Google Scholar 

  9. Chen, P., Choudhury, S., Rodriguez, L., III, A.O.H., Ray, I.: Enterprise cyber resiliency against lateral movement: a graph theoretic approach. CoRR (2019)

    Google Scholar 

  10. Chen, Z., Tong, H., Ying, L.: Realtime robustification of interdependent networks under cascading attacks. In: 2018 IEEE International Conference on Big Data (Big Data), pp. 1347–1356 (2018)

    Google Scholar 

  11. Chernikova, A., Gozzi, N., Boboila, S., Perra, N., Eliassi-Rad, T., Oprea, A.: Modeling self-propagating malware with epidemiological models (2022)

    Google Scholar 

  12. Chung, F., Lu, L., Vu, V.: Eigenvalues of random power law graphs. Ann. Comb. 7, 21–33 (2003)

    Article  MathSciNet  Google Scholar 

  13. Cloudflare: Inside the infamous Mirai IoT Botnet. https://blog.cloudflare.com/inside-mirai-the-infamous-iot-botnet-a-retrospective-analysis/. Accessed Apr 2022

  14. Coresecurity: What is Ryuk Ransomware? (2022). https://www.coresecurity.com/core-labs/articles/what-is-ryuk-ransomware

  15. Freitas, S., Wicker, A., Chau, D.H.P., Neil, J.: D\({}^{\text{2}}\)M: dynamic defense and modeling of adversarial movement in networks. In: SDM, pp. 541–549. SIAM (2020)

    Google Scholar 

  16. Freitas, S., Yang, D., Kumar, S., Tong, H., Horng (Polo) Chau, D.: Graph vulnerability and robustness: a survey. TKDE (2022)

    Google Scholar 

  17. Gan, C., Feng, Q., Zhang, X., Zhang, Z., Zhu, Q.: Dynamical propagation model of malware for cloud computing security. IEEE Access 8, 20325–20333 (2020)

    Article  Google Scholar 

  18. GitHub: Open-source code for investigating cyber network resilience (2022). https://github.com/neu-nds2/cyber-resilience

  19. Guillen, J.H., Del Rey, A.M., Casado-Vara, R.: Security countermeasures of a SCIRAS model for advanced malware propagation. IEEE Access 7, 135472–135478 (2019)

    Article  Google Scholar 

  20. Le, L.T., Eliassi-Rad, T., Tong, H.: MET: A fast algorithm for minimizing propagation in large graphs with small eigen-gaps. In: SDM, pp. 694–702 (2015)

    Google Scholar 

  21. Levy, N., Rubin, A., Yom-Tov, E.: Modeling infection methods of computer malware in the presence of vaccinations using epidemiological models: an analysis of real-world data. Int. J. Data Sci. Anal. 10(4), 349–358 (2020). https://doi.org/10.1007/s41060-020-00225-1

    Article  Google Scholar 

  22. Liao, C.M., Liu, W., Tang, S., Xiao, Y.: Model selection and evaluation based on emerging infectious disease data sets including A/H1N1 and Ebola. Comput. Math. Methods Med. (2015)

    Google Scholar 

  23. Louzada, V.H.P., Daolio, F., Herrmann, H.J., Tomassini, M.: Smart rewiring for network robustness. J. Complex Networks 1(2), 150–159 (2013)

    Article  Google Scholar 

  24. McKinley, T.J., et al.: Approximate Bayesian computation and simulation-based inference for complex stochastic epidemic models. Stat. Sci. 33(1), 4–18 (2018)

    Article  MathSciNet  Google Scholar 

  25. Microsoft Azure: Traffic Manager documentation (2022). https://docs.microsoft.com/en-us/azure/traffic-manager/

  26. Mike Azzara: What is wannacry ransomware and how does it work? https://www.mimecast.com/blog/all-you-need-to-know-about-wannacry-ransomware/

  27. Minter, A., Retkute, R.: Approximate Bayesian computation for infectious disease modelling. Epidemics 29, 100368 (2019)

    Article  Google Scholar 

  28. Mishra, B.K., Pandey, S.K.: Dynamic model of worm propagation in computer network. Appl. Math. Model. 38(7–8), 2173–2179 (2014)

    Article  MathSciNet  Google Scholar 

  29. Newman, M.E.J.: Modularity and community structure in networks. Proc. Natl. Acad. Sci. 103(23), 8577–8582 (2006)

    Article  Google Scholar 

  30. Newman, M.: The structure and function of complex networks. SIAM Rev. 45(2), 167–256 (2003)

    Article  MathSciNet  Google Scholar 

  31. Ojha, R.P., Srivastava, P.K., Sanyal, G., Gupta, N.: Improved model for the stability analysis of wireless sensor network against malware attacks. Wireless Pers. Commun. 116(3), 2525–2548 (2021)

    Article  Google Scholar 

  32. Zlotnik, O.: System hardening guidelines for 2022 (2021). https://www.hysolate.com/blog/system-hardening-guidelines-best-practices/

  33. Ongun, T., et al.: PORTFILER: port-level network profiling for self-propagating malware detection. In: IEEE CNS, pp. 182–190 (2021)

    Google Scholar 

  34. Pastor-Satorras, R., Vespignani, A.: Epidemics and immunization in scale-free networks. In: Handbook of Graphs and Networks. Wiley-VCH (2003)

    Google Scholar 

  35. Pastor-Satorras, R., Castellano, C., Van Mieghem, P., Vespignani, A.: Epidemic processes in complex networks. Rev. Mod. Phys. 87, 925–979 (2015)

    Article  MathSciNet  Google Scholar 

  36. Prakash, B., Chakrabarti, D., Faloutsos, M., Valler, N., Faloutsos, C.: Threshold conditions for arbitrary cascade models on arbitrary networks. Knowl. Inf. Syst. 33, 537–546 (2011)

    Google Scholar 

  37. Requiao Da Cunha, B., González-Avella, J., Gonçalves, S.: Fast fragmentation of networks using module-based attacks. PLoS ONE (2015)

    Google Scholar 

  38. Rey, A.: Mathematical modeling of the propagation of malware: a review. Secur. Commun. Networks 8 (2015)

    Google Scholar 

  39. Seals, Tara: Innovative PureLocker ransomware emerges in targeted attacks (2019). https://threatpost.com/purelocker-ransomware-targeted-attacks/150229/

  40. Stocks, T., Britton, T., Hohle, M.: Model selection and parameter estimation for dynamic epidemic models via iterated filtering: application to rotavirus in Germany. Biostatistics 21(3), 400–416 (2018)

    Article  MathSciNet  Google Scholar 

  41. Tong, H., Prakash, B.A., Eliassi-Rad, T., Faloutsos, M., Faloutsos, C.: Gelling, and melting, large graphs by edge manipulation. In: CIKM, pp. 245–254 (2012)

    Google Scholar 

  42. Tong, H., Prakash, B.A., Tsourakakis, C., Eliassi-Rad, T., Faloutsos, C., Chau, D.H.: On the vulnerability of large graphs. In: IEEE ICDM, pp. 1091–1096 (2010)

    Google Scholar 

  43. Torres, L., Chan, K., Tong, H., Eliassi-Rad, T.: Nonbacktracking eigenvalues under node removal: X-centrality and targeted immunization. SIAM J. Math. Data Sci. 3, 656–675 (2021)

    Article  MathSciNet  Google Scholar 

  44. Toutonji, O.A., Yoo, S.M., Park, M.: Stability analysis of VEISV propagation modeling for network worm attack. Appl. Math. Model. 36(6), 2751–2761 (2012)

    Article  MathSciNet  Google Scholar 

  45. Traag, V.A., Waltman, L., van Eck, N.J.: From Louvain to Leiden: guaranteeing well-connected communities. Sci. Rep. 9(1), 5233 (2019)

    Article  Google Scholar 

  46. Vespignani, A.: Modelling dynamical processes in complex socio-technical systems. Nat. Phys. 8(1), 32–39 (2012)

    Article  Google Scholar 

  47. Wikipedia: Structural holes. https://en.wikipedia.org/wiki/Structural_holes. Accessed Apr 2022

  48. Zhu, Q., Yang, X., Ren, J.: Modeling and analysis of the spread of computer virus. Commun. Nonlinear Sci. Numer. Simul. 17(12), 5117–5124 (2012)

    Article  MathSciNet  Google Scholar 

Download references

Acknowledgements

This research was sponsored by PricewaterhouseCoopers LLP and the U.S. Army Combat Capabilities Development Command Army Research Laboratory (DEVCOM ARL) under Cooperative Agreement Number W911NF-13-2-0045. The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of DEVCOM ARL or the U.S. Government. The U.S. Government is authorized to reproduce and distribute reprints for Government purposes notwithstanding any copyright notation here on.

Author information

Authors and Affiliations

  1. Northeastern University, Boston, MA, USA

    Alesia Chernikova, Simona Boboila, Tina Eliassi-Rad & Alina Oprea

  2. University of Greenwich, London, UK

    Nicolò Gozzi

  3. School of Mathematical Sciences, Queen Mary University of London, London, UK

    Nicola Perra

  4. PricewaterhouseCoopers LLP, Washington, DC, USA

    Priyanka Angadi, John Loughner & Matthew Wilden

Authors
  1. Alesia Chernikova
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Nicolò Gozzi
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Simona Boboila
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Priyanka Angadi
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. John Loughner
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. Matthew Wilden
    View author publications

    You can also search for this author in PubMed Google Scholar

  7. Nicola Perra
    View author publications

    You can also search for this author in PubMed Google Scholar

  8. Tina Eliassi-Rad
    View author publications

    You can also search for this author in PubMed Google Scholar

  9. Alina Oprea
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Alesia Chernikova .

Editor information

Editors and Affiliations

  1. Rutgers University, Newark, NJ, USA

    Vijayalakshmi Atluri

  2. Hamad Bin Khalifa University, Doha, Qatar

    Roberto Di Pietro

  3. Technical University of Denmark, Kongens Lyngby, Denmark

    Christian D. Jensen

  4. Technical University of Denmark, Kongens Lyngby, Denmark

    Weizhi Meng

Rights and permissions

Reprints and permissions

Copyright information

© 2022 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Chernikova, A. et al. (2022). Cyber Network Resilience Against Self-Propagating Malware Attacks. In: Atluri, V., Di Pietro, R., Jensen, C.D., Meng, W. (eds) Computer Security – ESORICS 2022. ESORICS 2022. Lecture Notes in Computer Science, vol 13554. Springer, Cham. https://doi.org/10.1007/978-3-031-17140-6_26

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-17140-6_26

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-17139-0

  • Online ISBN: 978-3-031-17140-6

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation