Security Countermeasures of a SCIRAS Model for Advanced Malware Propagation

Abstract

In the new and sophisticated cyber attacks (mainly, advanced persistent threats) the advanced specimens of malware such that zero-day malware play a crucial role. Due to its stealthy behavior it is very important to study and analyze its propagation process by designing mathematical models that could predict in an efficient way its spread on a network. With no doubt the computational implementation of these theoretical models leads to the develop of solutions to be used in the Security Operation Centers (SOC) with forensic purposes. The main goal of this work is to introduce a novel mathematical model to simulate advanced malware. Specifically, it is a compartmental and global SCIRAS (Susceptible-Carrier-Infectious-Recovered-Attacked-Susceptible) model where susceptible, carrier, infectious, recovered and attacked devices are considered. The local and global stability of its equilibrium points are studied and the basic reproductive number is computed. From the analysis of this epidemiological threshold, the most efficient security countermeasures are derived.INDEX TERMS Basic reproductive number, malware spread, mathematical model, advanced persistent threats, zero-day malware.

SIR1R2: Characterizing Malware Propagation in WSNs With Second Immunization

“…Xia et al [35] proposed an IDEPSR model for analyzing malware propagation in city IoT, which reflects social features including the propagation and identification abilities of smart devices. Hernandez et al [36] introduced an SCIRAS model for simulating the propagation process of zero-day malware, considering states Susceptible, Carrier, Infectious, Recovered, Attacked, and Susceptible. Li et al [37] proposed a DDSEIR model to analyze CPS malware propagation based on states Disseminate, Discriminate, Spread, Exposed, Ignorant, and Recover.…”

MalSEIRS: Forecasting Malware Spread Based on Compartmental Models in Epidemiology

“…Besides, authors in Ref. [13] analyzed a novel theoretical model to simulate the expansion of malware in WSNs. Particularly, they studied a SCIRS model that considers population dynamics, carrier (C) compartment, vaccinations, and possible reinfections.…”

“…e recovery or malware removal rate could also variate over time depending on the availability of treatment to be applied to infected nodes. At the beginning of a new malware campaign, it is expected that the recovery rate may be low, depending on the grade of the [11] Generalized SIR × × × ✓ Ojha et al [12] SEIQRV × × × × Hernandez Guillen et al [13] SCIRS…”

Propagation of the Malware Used in APTs Based on Dynamic Bayesian Networks

“…In this sense, several different compartments can be considered in a specific model: susceptible devices S, weak susceptible devices W, infectious devices I, carrier devices C, recovered devices R, vaccinated devices V, attacked devices A, damaged devices D, etc. In this way, considering the involved compartments and the dynamics between them, the epidemiological models are classified according to their dynamic: SCIRAS model [14], SCIRS model [15], SIRA model [16], SEIRS − V model [17], WSIS model [18], etc. The model introduced in this work is a SIDR model (susceptible-infectious-damaged-recovered).…”

“…Very few models have been proposed in the scientific literature to simulate the propagation of the advanced malware used in APTs. In [14], the authors propose a SCIRAS global and deterministic model based on ordinary differential equations. This is a theoretical proposal where the proposed model can simulate the general evolution of its five compartments (susceptible devices, carrier devices, infectious devices, attacked devices and recovered devices).…”