# Influence of Removable Devices' Heterouse on the Propagation of Malware

Authors: Xie Han; Yi-Hong Li; Li-Ping Feng; Li-Peng Song
Journal: Abstract and Applied Analysis
 (2013)

---

## Abstract

The effects of removable devices’ heterouse in different areas on the propagation of malware spreading via removable devices remain unclear. As a result, in this paper, we present a model incorporating the heterogeneous use of removable devices, obtained by dividing the using rate into local area’s rate, neighbour area’s rate and global area’s rate, and then getting the final rate by multiplying the corresponding area ratio. The model’s equilibria and their stability conditions are obtained mathematically and verified by deterministic and stochastic simulations. Simulation results also indicate that the heterogeneity in using rate significantly changes the prospective propagation course of malware. Additionally, the thresholds of removable devices’ using rate in neighbour area are given, which can guide us in designing effective countermalware method.


---

## Body

## 1. Introduction

The malicious programs or malware, including network worms, Trojan programs, and various botnets, have posed serious threats to the Internet [1–5]. Furthermore, removable devices have become a common propagation method by those recently detected malware, such as Stuxnet [6], Duqu [7], and Flame [8], which aim at controlling computers or other machinery, especially those physically isolated machines. Thus, it is very necessary to explore the propagation behavior and control strategies of such malware.To capture the influences of removable devices on malware, some mathematical models have been proposed [9–13]. In [9], Song et al. presented the model by coupling a susceptible-infected-recovered (SIR) model with a susceptible-infected-susceptible (SIS) model [14]. In the model, a removable device would be infected with a certain rate if it was used on an infectious computer and then the infected removable device can infect other computers whenever it was used on them. To depict the computers which have been infected but are not yet infectious, Jin and Wang [10] put forward the susceptible-exposed-infected-recovered (SEIR) model by introducing the “exposed” state into the SIR model. L. X. Yang and X. Yang [11] further considered the model where the “exposed” state had limited infection ability. However, all of these models were homogeneous models. That is to say, each removable device was used with the same probability on all computers.In [13], Peng et al. gave a model which divided the Internet into many subnets and assumed that removable devices were used equally within the subnet they belong to, but they were used with a lower probability outside the subnet. However, it is not a reasonable assumption that removable devices are homogeneously mixed with computers outside their subnet. Furthermore, under this assumption, they cannot give an effective defense method concerning removable devices’ using area and rate. Hence, we present a heterogeneous model in this paper, which can give an effective countermalware method by exploring the influences of removable devices’ using area and rate.The remainder of this paper is organized as follows: we give the model and interpret the parameters’ meanings in Section2. After that, we analyze its dynamical behavior and illustrate our mathematical results by simulations in Section 3. Then, some containment strategies are given in Section 4. In the end, we summarize our work.


## 2. The Model

The basic models used in this paper are the SIR model and the SIS model. There are five compartments in our model: susceptible computers (S); infected computers (I); immunized computers (R); susceptible media (MS)—removable devices without malicious programs; infected media (MI)—removable devices which have carried the malicious programs and can propagate them to susceptible computers.To depict the influences of removable devices’ using area and rate, we divide the whole area into many subareas and each removable device belongs to an area named the local area of the device. We also assume that removable devices are used equally within the local area and used with a lower probability in their neighbour areas but hardly used in any other areas named global area here.Letβ1 be the susceptible computer’s infection rate caused by the successful scans of an infected computer. β2 denotes susceptible computer’s infection rate (susceptible medium’s infection rate) due to an infected medium (an infected computer) in the same local area. N and M denote the total number of computers and the total number of removable devices, respectively. Here, we suppose that both N and M are constant. Then, the obsoleteness rate of computers (removable devices) is given by μ1 (μ2).To model the random discovery of infection by anti-virus program, the recovery rate of infected computers is given byδ1. When infected devices are used on susceptible or immunized computers, the malicious programs carried by infected devices are likely to be detected. We denote this rate by δ2.Then, the model is given as follows:(1)S˙=μ1N-β1SI232-D(·)β2SMIN-μ1S,I˙=β1SI232+D(·)β2SMIN-δ1I-μ1I,R˙=δ1I-μ1R,M˙S=μ2M-D(·)β2MSIN+δ2R+SNMI-μ2MS,M˙I=D(·)β2MSIN-δ2R+SNMI-μ2MI,
where D(·) is the function of removable devices’ using area and rate. For all removable devices, let α1(α2) denote the ratio of using rate in neighbour area (global area) to the counterpart in local area and let λ1(λ2) be the ratio of neighbour area’s (global area’s) radius to local area’s radius. Without loss of generality, both removable devices’ using rate in local area and local area’s radius are set to 1. Then,
(2)D(·)=1λ22+α1λ12λ22+α2(λ22-λ12-1)λ22.AsN=S+I+R and M=MS+MI, the model (1) can be rewritten as
(3)I˙=β1(N-I-R)I232+D(·)β2(N-I-R)MIN-δ1I-μ1I,R˙=δ1I-μ1R,M˙I=D(·)β2(M-MI)IN-δ2N-INMI-μ2MI.Let(4)R0=β1N232(δ1+μ1)+D(·)2β22M(δ1+μ1)(δ2+μ2)N,
where R0 is the basic reproduction number [15].For system (3), there are two equilibria: disease-free equilibrium E0=(0,0,0) and positive equilibrium E*=(I*,R*,MI*) when R0>1. The positive equilibrium is given by (5a)I*=-b+b2-4ac2a,(5b)R*=δ1μ1I*,(5c)MI*=D(·)β2MI*(D(·)β2-δ2)I*+(δ2+μ2)N,wherea=(β1(1+(δ1/μ1))(D(·)β2-δ2)N)/232, b=(β1(1+(δ1/μ1))(δ2+μ2)N2)/232+(δ1+μ1)(D(·)β2-δ2)N+D(·)2β22(1+(δ1/μ1))M-(β1(D(·)β2-δ2)N2)/232, and c=(δ1+μ1)(δ2+μ2)N2-(β1(δ2+μ2)N3)/232-D(·)2β22MN.


## 3. Model Analysis

Theorem 1.
IfR0<1, E0 is asymptotically stable.Proof.
The characteristic equation of (3) at E0 is given by
(6)det(λ-(β1N232-δ1-μ1)0-D(·)β2-δ1λ+μ10-D(·)β2MN0λ+δ2+μ2)=0.
Then, we have(7)(λ+μ1)[∑(λ-β1N232+δ1+μ1)(λ+δ2+μ2)(λ+μ1)-D(·)2β22MN∑]=0.
WhenR0<1, corresponding to (δ1+μ1-(β1N)/232)(δ2+μ2)-(D(·)2β22M)/N>0, all eigenvalues of (7) have negative real parts. Thus, E0 is asymptotically stable. The theorem is proven.Theorem 2.
IfR0>1, the endemic equilibrium E* is asymptotically stable.Proof.
The characteristic equation of (3) at E* is given by(8)det(λ-β1N232+β1(2I*+R*)232β1I*232+D(·)β2MI*N-D(·)β2(N-I*-R*)N+D(·)β2MI*N+δ1+μ1-δ1λ+μ10-D(·)β2(M-MI*)N-δ2MI*N0λ+D(·)β2I*N+δ2N-I*N+μ2)=0,
corresponding to(9)λ3+(a11+a22+a33)λ2λ3+(a11a22+a11a33+a22a33-a12a21-a13a31)λλ3+a11a22a33-a12a21a33-a13a31a22=0,
where a11=-(β1N)/232+(β1(2I*+R*))/232+(D(·)β2MI*)/N+δ1+μ1, a12=(β1I*)/232+(D(·)β2MI*)/N, a13=-(D(·)β2(N-I*-R*))/N, a21=-δ1, a22=μ1, a31=-(D(·)β2(M-MI*))/N-(δ2MI*)/N, and a33=(D(·)β2I*)/N+δ2(N-I*)/N+μ2.
According to the Hurwitz criteria [16, 17], we have
(10)H1=a11+a22+a33=D(·)β2(N-I*-R*)MI*NI*+β1I*232+D(·)β2MI*N+μ1+D(·)β2I*N+δ2N-I*N+μ2,H2=a112a22+a112a33+a11a222+a222a33+a11a332+a22a332+2a11a22a33-a11a12a21-a11a13a31-a12a21a22-a13a31a33>(a11a33-a13a31)(a11+a33)>[(-β1(N-I*-R*)232+δ1+μ1)×(δ2(N-I*)N+μ2)-D(·)β2(N-I*-R*)N×(D(·)β2(M-MI*)N+δ2MI*N)](a11+a33)=(-β1(N-I*-R*)I*232+δ1I*+μ1I*-D(·)β2(N-I*-R*)MI*N)(δ2N-I*NI*+μ2I*)=0,H3=(a11a22a33-a12a21a33-a13a31a22)H2>(a11a33-a13a31)a22H2>0.
IfR0>1, we have H1>0,H2>0, and H3>0 and then all eigenvalues of (9) have negative real parts. Thus, there exists an endemic equilibrium E* and it is asymptotically stable when R0>1. The proof is completed.To validate the accuracy of Theorems1 and 2, we used both deterministic method and stochastic method to simulate the system (3) with N=1000000, M=400000, μ1=μ2=0.00046, and β2=0.098 and two sets of other variables: (i) β1=0.24, δ1=0.05, and δ2=0.05, where R0≈5.98; (ii) β1=0.05, δ1=0.1, and δ2=0.1, where R0≈0.85.As shown in Figure1, when R0>1, in both deterministic and stochastic simulations, the number of infected computers tends to the theoretical value predicted by (5a) finally, which indicates an endemic state E*. However, in Figure 2, when R0<1, the steady-state number of I is zero in accordance with the number predicted by disease-free state E0.Figure 1
Fraction of infected computers whenR0>1. (a) Blue (dash line): deterministic simulation; (b) black (solid line): theoretical value; (c) purple (dot-dash line): stochastic simulation.Figure 2
Fraction of infected computers whenR0<1. (a) Blue (dash line): deterministic simulation; (b) black (solid line): theoretical value; (c) purple (dot-dash line): stochastic simulation.


## 4. Control Strategies

We first give the convergence proof of the numerical method, the improved Euler method, used in the simulation. LetI=(I,R,MI). Then, we can rewrite the system (3) as I˙=f(t,I). Obviously, f is a continuous and differential function in R4. Thus, f satisfies the Lipschitz condition and∥f(t,I1)-f(t,I2)∥≤L∥I1-I2∥, where L is a constant.The Euler iteration equation isIn+1(k+1)=In+(h/2)[f(tn,In)+f(tn+1,In+1(k))] where k=0,1,2,…, In+1(0)=In+hf(tn,In) and n=0,1,2,…. h=tn+1-tn, representing the step value in the Euler iteration algorithm. Then, we have
(11)∥In+1(k+1)-In+1(k)∥=h2∥f(tn+1,In+1(k))-f(tn+1,In+1(k-1))∥≤hL2∥In+1(k)-In+1(k-1)∥≤(hL2)2∥In+1(k-1)-In+1(k-2)∥≤⋯≤(hL2)k∥In+1(1)-In+1(0)∥.
Thus, the numerical technique used here is convergent as we can ensure that hL/2<1 by selecting a small value of h.In this paper, we also use a Monte Carlo algorithm to simulate the propagation of malware [18, 19]. In all simulations given below, we set N=M=1000000, μ1=μ2=0.00046, β1=0.06, β2=2, δ1=0.06, δ2=0.033, α2=0.0001, and λ2=32, where β1≪β2 because that malware such as Stuxnet is mainly spreading via removable devices to infect physically isolated machines. The initial numbers of I and MI are set to 1000 and 0, respectively.First, we compared three different models with the same parameters: homogeneous model presented in [9] where removable devices are assumed to be used with the same probability on all computers; heterogeneous model presented in [13] where the using rate of removable devices is divided into two rates (using rate on local computers and using rate on the other computers); and the model in this paper. We ran the simulation 100 times and got the average number of infected computers. Figure 3 shows the simulation results.Figure 3
Fraction of infected computers based on the model in this paper (blue, heterogeneous model where three areas divided according to the removable device’s using rate are considered) compared to the counterparts based on the model presented in [9] (green, homogeneous model) and in [13] (red, heterogeneous model where two areas are considered).As shown in Figure3, the model in this paper leads to the lowest infection rate and propagation speed. As it is established under the most reasonable assumptions among three models, its prediction is in accordance with the real propagation process to the most degree. The homogeneous model obtains the highest infection rate and the fastest propagation speed. Although the heterogeneity in removable devices’ using rate is included in the model given in [13], this simplistic division of removable devices’ using rate also leads to a great deviation.We also simulated variousα1 and λ1 to gain some insight into the containment of the malware considered in this paper. Figures 4(a) and 4(b) give the simulation results with fixed λ1 and fixed α1, respectively.Fraction of infected computers based on model (3) with (a) α1=0.4 (blue), 0.2 (green), 0.05 (red), and λ1=10; (b) λ1=10 (blue), 8 (green), 6 (red), and α1=0.2. The other parameters are the same as in Figure 3.
(a)
(b)Figures4(a) and 4(b) show that the radius of neighbour area (λ1) and the using rate (α1) in this area have great influences on the propagation of malware. The infection rate and speed decrease rapidly with the decrease of using rate (α1) or neighbour area’s radius (λ1). In Figure 4(a) with fixed λ1(10), the malware dies out directly when α1=0.05, which means an effective countermalware method.To get the effective countermalware thresholds under various values ofλ1, we further simulated the system (3) and got the values of α1 below which the malware would die out. Figure 5 plots the simulation results.Figure 5
The relationship betweenα1 and λ1 under the phase transition condition where μ1=0.00046, μ2=0.00046, β1=0.06, β2=2, δ1=0.06, δ2=0.033, α2=0.0001, and λ2=32.As it is shown in Figure5, the points in left area can guarantee the extinction of malware. However, the malware can self perpetuate in the right area. The threshold of α1 decreases with the increase of λ1 and this decrease is much faster in the area between two arrows (λ1*<λ1<5). Furthermore, when the radius of neighbour area is less than two times of the radius of local area, corresponding to λ1≤λ1* (=2), the malware will die out no matter what value α1 is, which gives a promising countermalware threshold.


## 5. Conclusion

Recently, the researches concerning malware have focused on those pieces malware spreading via removable devices [9–13]. Different from these researches, we present a model with a detailed depiction of the heterogeneity in removable devices’ using rate. This consideration of heterogeneity can lead to an effective countermalware method by controlling the removable devices’ using rate in neighbour area. Furthermore, when α1=α2=1, the model presented in this paper corresponds to the model given in [9, 12]; when α1=α2<1, it corresponds to the model given in [13]. Thus, the model in this paper is a more general model and can depict the malware’s spreading process more precisely.Mathematical analysis and stochastic simulations indicate that the dynamics are determined by the value ofR0. Simulation results have also shown that removable devices’ using rate and the radius of neighbour area have great influences on the dynamics of malware. Specifically, we have obtained the thresholds of removable devices’ using rate (α1) when different values of λ1 (the radius of neighbour area) are considered, which can guide us in designing effective countermalware method.In the future, we plan to use real trace data to test our model, especially the special value of removable devices’ using area (λ1*) and then get the most effective policy to help people in defending their devices and machines against malware.



---

*Source: 296940-2013-11-13.xml*