Automatically Protecting Network Communities by Malware Epidemiology

摘要

Malware epidemiology, specifically the modelling and simulation of malware propagation, has been theorised to improve malware outbreak preparedness and drive decision making during real time epidemics. However, practical methods to make use of malware epidemiology are significantly lacking at every level, whether within organisations or at country and global levels. To fill this gap, we present a novel and automatic method to protect networks with a community structure using the malware epidemic final size, one of the most important metrics of a malware outbreak. We treat the final size probabilities abstracted from the simulations as a "signal". We process the "signal" so that the final sizes can be correlated with communities identified within the network to gain practically usable insights. Finally, we define thresholds and rules built on such insights to deploy automatic protection on the network of concern. To our knowledge, this is the first attempt to make use of malware propagation simulation results as a signal. We show that not only theoretically, but practically malware epidemiology can be used in an automatic manner to protect networks. This study should act as the foundation and inspiration for industrial deployments of malware epidemiology.