Evaluating the Performance of a Static Patching Strategy against Computer Viruses

Abstract

To cope with evolving computer viruses, antivirus programs must be periodically updated. Due to the limited network bandwidth, new virus patches are typically injected into a small subset of network nodes and then forwarded to the remaining nodes. A static patching strategy consists of a fixed patch injection rate and a fixed patch forwarding rate. This paper focuses on evaluating the performance of a static patching strategy. First, we introduce a novel autonomous node-level virus-patch propagation model to characterize the effect of a static patching strategy. Second, we show that the model is globally attracting, implying that regardless of the initial expected state of the network, the expected fraction of the infected nodes converges to the same value. Therefore, we use the asymptotic expected fraction of the infected nodes as the measure of performance of a static patching strategy. On this basis, we evaluate the performances of a few static patching strategies. Finally, we examine the influences of a few parameters on the performance of a static patching strategy. Our findings provide a significant guidance for restraining malware propagation.