Propagation of the Malware Used in APTs Based on Dynamic Bayesian Networks

Mathematics

Jose D. Hernandez Guillen¹  Roberto Casado-Vara²  Angel Martin del Rey³ 

[1] Department of Applied Mathematics, University of Salamanca, 37008 Salamanca, Spain;Department of Mathematics and Computation, University of Burgos, 09007 Burgos, Spain;Institute of Fundamental Physics and Mathematics, Department of Applied Mathematics, University of Salamanca, 37008 Salamanca, Spain;

关键词: malware propagation;    epidemic model;    Bayesian network;    advanced persistent threat;    stochastic model;   

DOI  :  10.3390/math9233097

来源: DOAJ

【 摘 要 】

Malware is becoming more and more sophisticated these days. Currently, the aim of some special specimens of malware is not to infect the largest number of devices as possible, but to reach a set of concrete devices (target devices). This type of malware is usually employed in association with advanced persistent threat (APT) campaigns. Although the great majority of scientific studies are devoted to the design of efficient algorithms to detect this kind of threat, the knowledge about its propagation is also interesting. In this article, a new stochastic computational model to simulate its propagation is proposed based on Bayesian networks. This model considers two characteristics of the devices: having efficient countermeasures, and the number of infectious devices in the neighborhood. Moreover, it takes into account four states: susceptible devices, damaged devices, infectious devices and recovered devices. In this way, the dynamic of the model is $SIDR$ (susceptible–infectious–damaged–recovered). Contrary to what happens with global models, the proposed model takes into account both the individual characteristics of devices and the contact topology. Furthermore, the dynamics is governed by means of a (practically) unexplored technique in this field: Bayesian networks.

【 授权许可】

Unknown