Open Problems in Computer Virology

Filiol, Éric; Helenius, Marko; Zanero, Stefano

doi:10.1007/s11416-005-0008-3

Cited by 33 publications

(18 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Thus, the optimal control problem posed in section II can now be modified to augment (1) with (5) and (6), and omit (4b), without any alterations in the set of optimal solutions and in the maximum value of the damage function. We consider this version henceforth.…”

Section: Worm's Optimal Controlmentioning

confidence: 99%

“…This is again in contradiction with property 1. 6 For a general function f (x), the notations f (x + 0 ) and f (x − 0 ) are defined as lim x↓x 0 f (x) and lim x↑x 0 f (x), respectively. Therefore, none of the three cases could occur, which is a contradiction with existence of t * .…”

Section: Theoremmentioning

confidence: 99%

“…The first step in devising efficient countermeasures is to anticipate malware hazards, and understand the threats they pose, before they emerge in the hands of the attackers [6]. Recognizing the above, specific attacks such as the wormhole [7], sinkhole [1], and Sybil [8], that utilize vulnerabilities in the routing protocols in a wireless sensor network, and their counter-measures, have been investigated before they were actually launched.…”

Section: Introduction A) Motivationmentioning

confidence: 99%

See 2 more Smart Citations

Maximum Damage Malware Attack in Mobile Wireless Networks

Khouzani

Sarkar

Altman

2012

IEEE/ACM Trans. Networking

View full text Add to dashboard Cite

Malware attacks constitute a serious security risk that threatens to slow down the large scale proliferation of wireless applications. As a first step towards thwarting this security threat, we seek to quantify the maximum damage inflicted on the system owing to such outbreaks and identify the most vicious attacks. We represent the propagation of malware in a battery-constrained mobile wireless network by an epidemic model in which the worm can dynamically control the rate at which it kills the infected node and also the transmission range and/or the media scanning rate. At each moment of time, the worm at each node faces the following tradeoffs: (i) using larger transmission range and media scanning rate to accelerate its spread at the cost of exhausting the battery and thereby reducing the overall infection propagation rate in the long run or (ii) killing the node to inflict a large cost on the network, however at the expense of loosing the chance of infecting more susceptible nodes at later times. We mathematically formulate the decision problems and utilize Pontryagin Maximum Principle from optimal control theory to quantify the damage that the malware can inflict on the network by deploying optimum decision rules. Next, we establish structural properties of the optimal strategy of the attacker over time. Specifically, we prove that it is optimal for the attacker to defer killing of the infective nodes in the propagation phase for a certain time and then start the slaughter with maximum effort. We also show that in the optimal attack policy, the battery resources are used according to a decreasing function of time, i.e., mostly during the initial phase of the outbreak. Finally, our numerical investigations reveal a framework for identifying intelligent defense strategies that can limit the damage by appropriately selecting network parameters. Abstract-Malware attacks constitute a serious security risk that threatens to slow down the large scale proliferation of wireless applications. As a first step towards thwarting this security threat, we seek to quantify the maximum damage inflicted on the system owing to such outbreaks and identify the most vicious attacks. We represent the propagation of malware in a battery-constrained mobile wireless network by an epidemic model in which the worm can dynamically control the rate at which it kills the infected node and also the transmission range and/or the media scanning rate. At each moment of time, the worm at each node faces the following trade-offs: (i) using larger transmission range and media scanning rate to accelerate its spread at the cost of exhausting the battery and thereby reducing the overall infection propagation rate in the long run or (ii) killing the node to inflict a large cost on the network, however at the expense of loosing the chance of infecting more susceptible nodes at later times. We mathematically formulate the decision problems and utilize Pontryagin Maximum Principle from optimal control theory to quantify the damage that the mal...

show abstract

Section: Worm's Optimal Controlmentioning

confidence: 99%

Section: Theoremmentioning

confidence: 99%

Section: Introduction A) Motivationmentioning

confidence: 99%

See 1 more Smart Citation

Maximum Damage Malware Attack in Mobile Wireless Networks

Khouzani

Sarkar

Altman

2012

IEEE/ACM Trans. Networking

View full text Add to dashboard Cite

show abstract

“…The first step in devising efficient countermeasures is to anticipate the hazards and understand the threats the attacks pose, before they are launched [5]. Specific attacks such as the wormhole [6], sinkhole [2], and Sybil [7], that utilize vulnerabilities in the routing protocols in a wireless sensor network, and their counter-measures, had been investigated proactively.…”

Section: A Motivation and Overturementioning

confidence: 99%

Maximum Damage Battery Depletion Attack in Mobile Sensor Networks

Khouzani

Sarkar

2011

IEEE Trans. Automat. Contr.

View full text Add to dashboard Cite

Abstract-Developing reliable security measures against outbreaks of malware will facilitate the proliferation of wireless sensing technologies. The first step toward this goal is to investigate potential attack strategies and the extent of damage they can incur. The malware at each infective node may seek to contact more susceptible nodes by amplifying the transmission range and the media scanning rate and thereby accelerate its spread. This may however lead to (a) easier detection of the malware and thus more effective counter-measure by the network, and (b) faster depletion of the battery which may in turn thwart further spread of the infection and/or exploitation of that node. We assume the viewpoint of the malware and cast the problem of dynamically selecting the transmission range and media access rate of the infective nodes as an optimal control problem. We utilize Pontryagin's maximum principle to find an optimum solution, and prove that the maximum damage can be attained using simple three-phase bang-bang strategies.

show abstract

“…(e.g., a macro virus resides on a machine, another macro virus reaches it, and "mutates" into a third virus.) Filiol et al [7] analyzed the complexity of another type of viruses named k-ary viruses, which combine actions of multiple attacks. Our aim is to study the effectiveness of two techniques that have been applied in the context of "traditional" network worms: statistical analysis of content to identify portions of input that deviate from expected normal content as estimated from a training corpora, and detection of malicious behavior by dynamic execution on multiple, diverse platforms.…”

Section: Dormant Malcode In Multi-partite Attacksmentioning

confidence: 99%

A Study of Malcode-Bearing Documents

Stolfo

Stavrou

et al. 2007

Detection of Intrusions and Malware, and Vulnerability Assessment

View full text Add to dashboard Cite

Abstract. By exploiting the object-oriented dynamic composability of modern document applications and formats, malcode hidden in otherwise inconspicuous documents can reach third-party applications that may harbor exploitable vulnerabilities otherwise unreachable by network-level service attacks. Such attacks can be very selective and difficult to detect compared to the typical network worm threat, owing to the complexity of these applications and data formats, as well as the multitude of document-exchange vectors. As a case study, this paper focuses on Microsoft Word documents as malcode carriers. We investigate the possibility of detecting embedded malcode in Word documents using two techniques: static content analysis using statistical models of typical document content, and run-time dynamic tests on diverse platforms. The experiments demonstrate these approaches can not only detect known malware, but also most zero-day attacks. We identify several problems with both approaches, representing both challenges in addressing the problem and opportunities for future research.

show abstract

Open Problems in Computer Virology

Cited by 33 publications

References 26 publications

Maximum Damage Malware Attack in Mobile Wireless Networks

Maximum Damage Malware Attack in Mobile Wireless Networks

Maximum Damage Battery Depletion Attack in Mobile Sensor Networks

A Study of Malcode-Bearing Documents

Contact Info

Product

Resources

About