Modeling Internet-Scale Policies for Cleaning up Malware

Hofmeyr, Steven; Moore, Tyler; Forrest, Stephanie; Edwards, Benjamin; Stelle, George

doi:10.1007/978-1-4614-1981-5_7

Cited by 9 publications

(7 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Traffic dynamics affect the concentration of malicious hosts [25], but appropriate network traffic datasets are not publicly available. Numerous models of traffic flow have been proposed for the AS network, ranging from simple [64] to elaborate [5], and for this study we adapted Roughan et al's gravity model [64] to simulate malicious traffic between nodes in the ISP graph.…”

Section: Network Traffic Dynamicsmentioning

confidence: 99%

“…These predictions could be incorporated into our model to better predict some of the large changes in wickedness over time. A model of global malware dynamics was also proposed by Hofmeyr et al, which used an agent-based model to investigate the dynamics of malicious traffic flowing across the Internet at the AS level [25]. This model was significantly more abstract than ours, and did not incorporate actual data about spam, ISPs, demographic features, or intervention events such as takedowns.…”

Section: Related Workmentioning

confidence: 99%

“…To compare spam levels across countries, we study a quantity called wickedness [25], which can be thought of as the concentration of infected machines sending out spam, either in a single Internet Service Provider (ISP) or in a geographic region. This measure allows us to compare spam levels among different countries or different ISPs, identify how different factors contribute to the concentration of spam sending computers, and assess what effect interventions have across the globe.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Analyzing and Modeling Longitudinal Security Data

Edwards¹,

Hofmeyr

Forrest

et al. 2015

Proceedings of the 31st Annual Computer Security Applications Conference

Self Cite

View full text Add to dashboard Cite

Many cybersecurity problems occur on a worldwide scale, but we lack rigorous methods for determining how best to intervene and mitigate damage globally, both short-and long-term. Analysis of longitudinal security data can provide insight into the effectiveness and differential impacts of security interventions on a global level. In this paper we consider the example of spam, studying a large high-resolution data set of messages sent from 260 ISPs in 60 countries over the course of a decade. The statistical analysis is designed to avoid common pitfalls that could lead to erroneous conclusions. We show how factors such as geography, national economics, Internet connectivity and traffic flow impact can affect local spam concentrations. Additionally, we present a statistical model to study temporal transitions in the dataset, and we use a simple extension of the model to investigate the effect of historical botnet takedowns on spam levels. We find that in aggregate most historical takedowns are beneficial in the short-term, but few have long-term impact. Further, even when takedowns are effective globally, they can be detrimental in specific geographic regions or countries. The analysis and modeling described here are based on a single data set. However, the techniques are general and could be adapted to other data sets to help improve decision making about when and how to deploy security interventions.

show abstract

Section: Network Traffic Dynamicsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Analyzing and Modeling Longitudinal Security Data

Edwards¹,

Hofmeyr

Forrest

et al. 2015

Proceedings of the 31st Annual Computer Security Applications Conference

Self Cite

View full text Add to dashboard Cite

show abstract

“…(b) Power-law website popularity eled responses available to ISPs [12]. Other researchers have identified suitable intervention strategies based on empirical research, which might also be amenable to depreferencing.…”

Section: Related Workmentioning

confidence: 99%

Beyond the blacklist

Edwards

Moore

Stelle

et al. 2012

Proceedings of the 2012 New Security Paradigms Workshop

Self Cite

View full text Add to dashboard Cite

Malware spread among websites and between websites and clients is an increasing problem. Search engines play an important role in directing users to websites and are a natural control point for intervening using mechanisms such as blacklisting. The paper presents a simple Markov model of malware spread through large populations of websites and studies the effect of two interventions that might be deployed by a search provider: blacklisting infected web pages by removing them from search results entirely and a generalization of blacklisting, called depreferencing, in which a website's ranking is decreased by a fixed percentage each time period the site remains infected. We analyze and study the trade-offs between infection exposure and traffic loss due to false positives (the cost to a website that is incorrectly blacklisted) for different interventions. As expected, we find that interventions are most effective when websites are slow to remove infections. Surprisingly, we also find that low infection or recovery rates can increase traffic loss due to false positives. Our analysis also shows that heavy-tailed distributions of website popularity, as documented in many studies, leads to high sample variance of all measured outcomes. This result implies that it will be difficult to determine empirically whether certain website interventions are effective, and it suggests that theoretical models such as the one described in this paper have an important role to play in improving web security.

show abstract

“…Several studies have focused on alternative intervention strategies, which could potentially be generalized using our depreferencing method. For example, Hofmeyr et al modeled responses available to ISPs [27]. Other researchers have identified suitable intervention strategies based on empirical research, which might also be amenable to depreferencing.…”

Section: Related Workmentioning

confidence: 99%

Beyond the Blacklist: Modeling Malware Spread and the Effect of Interventions

Edwards,

Moore,

Stelle

et al. 2012

Preprint

Self Cite

View full text Add to dashboard Cite

Malware spread among websites and between websites and clients is an increasing problem. Search engines play an important role in directing users to websites and are a natural control point for intervening, using mechanisms such as blacklisting. The paper presents a simple Markov model of malware spread through large populations of websites and studies the effect of two interventions that might be deployed by a search provider: blacklisting infected web pages by removing them from search results entirely and a generalization of blacklisting, called depreferencing, in which a website's ranking is decreased by a fixed percentage each time period the site remains infected. We analyze and study the trade-offs between infection exposure and traffic loss due to false positives (the cost to a website that is incorrectly blacklisted) for different interventions. As expected, we find that interventions are most effective when websites are slow to remove infections. Surprisingly, we also find that low infection or recovery rates can increase traffic loss due to false positives. Our analysis also shows that heavy-tailed distributions of website popularity, as documented in many studies, leads to high sample variance of all measured outcomes. These result implies that it will be difficult to determine empirically whether certain website interventions are effective, and it suggests that theoretical models such as the one described in this paper have an important role to play in improving web security.

show abstract

Modeling Internet-Scale Policies for Cleaning up Malware

Cited by 9 publications

References 20 publications

Analyzing and Modeling Longitudinal Security Data

Analyzing and Modeling Longitudinal Security Data

Beyond the blacklist

Beyond the Blacklist: Modeling Malware Spread and the Effect of Interventions

Contact Info

Product

Resources

About