Can you infect me now?

Abstract

In this paper we evaluate the effects of malware propagating using communication services in mobile phone networks. Although self-propagating malware is well understood in the Internet, mobile phone networks have very different characteristics in terms of topologies, services, provisioning and capacity, devices, and communication patterns. To investigate malware in this new environment, we have developed an event-driver simulator that captures the characteristics and constraints of mobile phone networks. In particular, the simulator models realistic topologies and provisioned capacities of the network infrastructure, as well as the contact graphs determined by cell phone address books. We evaluate the speed and severity of random contact worms in mobile phone networks, characterize the denial-of-service effects such worms could have on the network, investigate approaches to accelerate malware propagation, and discuss the implications of defending networks against such attacks.

High Performance Scalable and Expressive Modeling Environment to Study Mobile Malware in Large Dynamic Networks

“…For example, random waypoint mobility models are known to create a higher density of devices in the center of the region considered [15,16], thus creating dense networks under stable conditions. Fleizach et al [31] investigate the effect of malware propagation over the wireless backbone net-works. They characterize the speed and severity of the malware under realistic scenarios and explore network-based defenses against such malware.…”

“…Some of them [94] consider lower resolution information for mapping the devices (although this is good enough for SMS/MMS malware). Others [98,100,103,89,31] use small size networks, and detailed packet level simulations to study the proximity-based propagation. The study of the spread of malware through simulations can be accomplished with varying levels of accuracy, complexity, and scalability.…”

Mathematical network models applied to the analysis of mobile applications behavior

“…By selecting the behaviors from our set that best fit the these two values and the 95% confidence interval, as explained in Section 3.4, we would obtain the results shown in Figure 2.2. With our simulations, we are able to capture the real behavior of the App1 (red points in Figure 2.2) until the 28-th day after the app launch, since data d (14), d (21) and d (28) is inside the 95% confidence interval generated by the proposed method. Notice that, although the value corresponding to 34-th day, d (34), lies outside the confidence interval, it is not far from the 95% CI.…”

“…In Figure 2.7, the predicted behavior and 95% confidence interval of the number of accumulated downloads vs. time, based on data from d(5) and d(7) corresponding to the 5-th and 7-th days respectively, are shown. With data from d(5) and d (7) we can predict correctly the behavior of the accumulated downloads until d (14). The model is able to capture the real behavior for 11-th and 14-th days, whose total number of accumulated downloads are given by d(11) and d (14), respectively.…”

“…In [19,25,29] the authors propose approaches based on mathematical epidemic techniques where the malware infection follows similar dynamics to the infectious diseases. Also, there are models based on the physical architecture of the mobile and wireless networks [14] or on the mobility of the users, but they do not consider the interconnectivity based on the exchange of applications [25]. To the best of our knowledge, none paper showing quantification, prediction and/or simulation about how the users install malware apps.…”