# Teletraffic Analysis of DoS and Malware Cyber Attacks on P2P Networks under Exponential Assumptions
## 4 Malware and DoS Attacks in the P2P Network
### Malware  
Malicious code or malware is the generic term used to designate any informatic program created deliberately to carry out an unauthorized activity that, in numerous instances, is harmful to the system in which it has been lodged. It is a complex piece of software that is capable of complicated attacks, such as collecting all kinds of information. The unauthorized activity of malware (payload) may range from a simple erasure of files to the retrieval and later use of private and/or confidential information (websites visited, contact lists, passwords, account numbers, etc.). Occasionally, the activity performed by the malware may provide some benefit to its creator or disseminator [46]. The flow chart for this attack is depicted in Figure 2.  
Malware is currently one of the main threats to information security. Far from decreasing, this threat (and the effects thereof) will expand considerably in the coming years, mainly because of improvements in its techniques and goals. In the case of malware distribution in P2P networks, the threat and impact are even higher since the intrinsic operation of the system relies on nodes sharing data among peers that are not even known or identified to many nodes, and this file is shared among all users of the system. Hence, it is of paramount importance to quantify the impact of such attacks.  
In this work, we consider that the malicious nodes are present from the beginning of the download process, with \(N_{i}\) nodes attacking the network. The rationale for this is that, for these types of attacks, there is no need to maintain an _active_ attack since the P2P system is very efficient at propagating the malware given a sufficiently high value of \(N_{i}\). In this way, the attacker is less likely to get detected since it only provided an initial number of infected seeds, and no new malicious nodes are introduced afterward. This number remains fixed, and no new malicious nodes are added during the operation of the system. We also consider that when a peer enters into contact (i.e., downloads one or more chunks) with an infected peer, it automatically becomes infected. Given the developed analysis, we believe this represents an important baseline model that allows the relaxation of these assumptions in future work if required.  
A technique [47] for efficient and effective malware detection is to build models of the malicious samples offline and then verify at run-time if the behavior of a suspicious application adheres to a known model. Ref. [48] used hierarchical behavior specifications to build a model of a malicious program. As the number of malicious samples continues to grow, efficiency is essential, not only for detectors, but also for automatic malware analysis systems. To address this problem, [49] proposed a technique that allows detection of whether a binary is a polymorphic variant of a malware sample that has already been analyzed in the past.  
Malicious software has a wide range of analysis avoidance techniques that it can employ to hinder forensic analysis. A review of the literature [50] on malware analysis methodologies found that the most effective methodologies take the presence of analysis avoidance techniques into account [51]. [PERSON]. [52] presented an incremental, static, and dynamic spiral analysis methodology for analyzing malware that additionally holds the analysis environment as the understanding of the malware is attained.