Mathematical Models of Malware Propagation: A Critical Level of Protection (CLoP)

Abstract

The use of the Internet to undertake violent acts that threaten loss of life or other forms of unwanted effects, such as data loss, potential economic loss, and insecure situations is alarming. This includes the attack to personal computers attached to the Internet by sending unwanted objects, such as computer viruses, computer worms, phishing, and other malicious software. This paper presents a mathematical model of the dynamics of the propagation of malwares or computer viruses on a computer network. The model is inspired by an SIR model in epidemiology, in which here the computer population in the network is divided into several subpopulations to include the susceptible (S), infected (I), and recovered (R) subpopulations. Mathematically, the SIR type model forms a system consisting of coupled differential equations to describe the infection process among subpopulations. Standard tools and analysis from dynamical system theory usually are utilized to find both the transient and equilibrium solutions of the models under investigation. We are especially interested in determining the long-term status of a computer network, whether the network will be free from the malware/virus or persists with the infection of the malware/virus, whenever anti-malware or anti-virus is 
given to some susceptible computers as an attempt to protect the computers from the malware or virus attack. Threshold parameters to determine the long-term status of the system will be investigated for SIR model and some of its generalization such as SEIR, SEIQRS, and SEIIQR.