Interplay Between Malware Epidemics and Honeynet Potency in Industrial Control System Network

Abstract

The Industrial Control System (ICS) is widely used in industrial processes, such as power grids, water conservancy, natural gas, petrochemical and so on. More and more cyber attacks are targeting the ICS worldwide. This paper presents a novel honeynet-based epidemic model in ICS network. The honeynet is an active approach that can attract malware attacks and provide sample information and immunization strategy of the malware. An epidemic model with immunization and quarantine in ICS network is formulated to explore the dynamics of the malware propagation, and the honeynet potency is analyzed as well. Theoretical analysis reveals the disease-free and endemic equilibrium of our model, then the local and global stability of the disease-free (endemic) equilibrium are examined by the basic reproduction number. Furthermore, numerical experiments show that the honeypot with more system vulnerabilities is conducive to suppress the malware epidemic, and the honeynet with lower average degree power low index can be more effectively. In addition, simulation experiments provide the actual behavior of malware propagation in the ICS network and verification of our derivations.

Dynamics of Botnet Propagation in Software Defined Networks Using Epidemic Models

“…However, the model does not consider the chance of the nodes being infected again after the malware is removed which is possible as we already stated. Models developed for specific scenarios and environments can be also found for mobile wireless sensors networks (WSN) [19], [20], [35], [36]; mobile devices [21], [37]; social networks [22], [38]; IoT networks [23]; industrial control system (ICS) networks [24].…”

“…Epidemic models have been extensively used as a mathematical tool that allows to understand malware spread across communication networks. Early examples that used such approach can be found in [15], [16], that were subsequently taken as a reference by different authors [17]- [24]. Modelling allows to identify key features of the infection process and provide insights on the proliferation dynamics, which helps to develop detection and mitigation countermeasures against malware distribution within networks.…”