Malware Propagation and Prevention Model for Time-Varying ...downloads.hindawi.com/journals/scn/2017/2910310.pdf · Tang and Li investigated malware spread in Wireless SensorNetworks(WSNs)throughSusceptible-Infective(SI)

Research ArticleMalware Propagation and Prevention Model for Time-VaryingCommunity Networks within Software Defined Networks

Lan Liu,1,2 Ryan K. L. Ko,2 Guangming Ren,1 and Xiaoping Xu1

1School of Electronics & Information, Guangdong Polytechnic Normal University, Guangzhou 510665, China2Cyber Security Lab, Department of Computer Science, University of Waikato, Hamilton, New Zealand

Correspondence should be addressed to Lan Liu; [email protected]

Received 10 December 2016; Revised 18 February 2017; Accepted 5 March 2017; Published 28 March 2017

Academic Editor: Angel Martın Del Rey

Copyright © 2017 Lan Liu et al. This is an open access article distributed under the Creative Commons Attribution License, whichpermits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

As the adoption of Software Defined Networks (SDNs) grows, the security of SDN still has several unaddressed limitations. Akey network security research area is in the study of malware propagation across the SDN-enabled networks. To analyze thespreading processes of network malware (e.g., viruses) in SDN, we propose a dynamic model with a time-varying communitynetwork, inspired by research models on the spread of epidemics in complex networks across communities. We assume subnetsof the network as communities and links that are dense in subnets but sparse between subnets. Using numerical simulation andtheoretical analysis, we find that the efficiency of network malware propagation in this model depends on the mobility rate 𝑞 of thenodes between subnets. We also find that there exists a mobility rate threshold 𝑞𝑐. The network malware will spread in the SDNwhen the mobility rate 𝑞 > 𝑞𝑐. Themalware will survive when 𝑞 > 𝑞𝑐 and perish when 𝑞 < 𝑞𝑐. The results showed that our model iseffective, and the results may help to decide the SDN control strategy to defend against network malware and provide a theoreticalbasis to reduce and prevent network security incidents.

1. Introduction

With separate control and data planes for computer network-ing [1], Software Defined Networks (SDNs) are consideredby many to be a promising network platform as it empowersprogrammability and flexible configuration—paving the wayfor more powerful network control and traffic data analysis.However, the SDN architecture also introduces complexityand increased risks to network security. With the continuousdevelopment of SDN security applications, we need to antic-ipate issues that might arise throughout the implementationof SDN-based security applications.

At their core, SDN computer networks are complex sys-tems [2].The research content of computer networks includesnetwork topology, network traffic characteristics, and theinfluence of the network behavior on the whole network.Thespread and prevention of network malware are key technolo-gies studied in SDN and have been one of the most prolificfields in complex network dynamics research. Through ourresearch, we found that some characteristics of computer

network virus propagation are similar to real world epidemicspread.

Compared to past computer network architectures(where it is not easy to control the whole network from theglobal level), SDNs are considered by many to be a promisingnetwork platform as it empowers programmability andflexible configuration—enabling powerful network controland traffic data analysis. As such, the study of the transitionprobability for malware within SDN makes not just aninteresting endeavor but also an important research areaconsidering upcoming trends in computer networking.Hence, in this research, we present a simple network modelwith a time-varying community network and investigatenetwork malware spreading processes within this model. Interms of scope, this paper does not consider the source andthe specific types of the malware.

The remainder of the paper is organized as follows.Section 2 discusses the background and related work. In Sec-tion 3, a model with a time-varying community network of

HindawiSecurity and Communication NetworksVolume 2017, Article ID 2910310, 8 pageshttps://doi.org/10.1155/2017/2910310

https://doi.org/10.1155/2017/2910310

2 Security and Communication Networks

malware propagation in SDN is proposed. Then, in Sec-tion 4, we implement a numerical simulation to evaluate theinfluences of the mobility rate on the dynamic behavior ofSDN, and the theoretical analysis of this model is performed.In Section 5, the possible applications of our research arepresented. Finally, we conclude and offer prospective areas forfuture research in Section 6.

2. Background and Related Work

2.1. Industry Trends. This research paves the way for practicalimplementations using SDN as a platform for malwarepropagation control. In the industry, Google has alreadydeployed SDN for data center backbone traffic. Major com-mercial switch vendors including Cisco, IBM, HP, Dell, andJuniper Networks have announced intent to support or havealready launched switching products that support SDN. Wesee a lot of potential in applying our research into similarenvironments.

Themarket research company IDC predicts that the mar-ket for SDN applications will reach $37 billion by 2016 [3]. Itis also realistic to expect malware (e.g., network viruses, Bot-nets) to continue to be a threat for future SDN deployments.Specifically, we witness a recent surge inmalware (e.g., Mirai)specifically designed for launching Distributed Denial-of-Service (DDOS) attacks to network-connected assets. Toassure Internet security, effective detection malwares areindispensable. Our research addresses these issues directly.

2.2. Research Trends and Gaps. Research on the networksecurity of SDN raised concern in recent years. Most priorstudies have looked at the development and analysis of SDNsecurity applications [4]. However, few solutions provide aneffective defense mechanism against the threat of attacks inSDNs because all types of open applications make the end-hosts and switches the target of attacks, which is a threat to theentire network [5]. In all types of security incidents, networkmalware usually spreads quickly and has a strong influenceon availability, making network malware the most importantissue to resolve in Internet security.

The control plane of SDN will have direct control overthe data plane elements [6]. Network administrators of SDNsoften use programmable soft switches to provide network vir-tualization.Modifying routing rules in traditional networks isdifficult but easier in SDNs, which will help address problemsin traditional networks and is advantageous to adjust theroute strategy of the entire network.The logical centralizationof network intelligence presents exciting challenges andopportunities to enhance security in such networks, includ-ing new ways to prevent, detect, and react to threats, as wellas innovative security services and applications that are builtupon SDN capabilities.Malicious code detection and preven-tion under the new architecture need further study [7–14].

At its core, the spread of networkmalware on the Internetis a dynamic complex network challenge. In complex networkdynamics, if the network evolution speed is slower thanthe information transmission speed, it can be approximatelyregarded as a static network. This assumption is set up in

many cases, such as computer malware spreading on theInternet. Therefore, we consider that the community struc-tures in complex networkmodels have considerable influenceon the spreading of network malware in SDN.

In recent years, many studies have indicated that time-varying networks play an important role in the investigationof the network malware spreading that occurs in complexnetworks [15]. In computer networks, we can assume subnetsas “communities” and “links” that are dense in a subnet butsparse between subnets. Network malware spreading is rapidin the subnets but slow between subnets. Because differentsubnets are disparate, it is impossible for individuals topropagate malware to different subnets at the same time evenif these individuals have connections with many differentsubnets in a static network. Thus, there are no links amongsubnets at each time step in a time-varying network, but indi-viduals can move among subnets because of the centralizedcontrol of SDN [16].

Toutonji and Yoo proposed a model Passive WormDynamic Quarantine (PWDQ) to enable network malwaredetection and protection [17]. When a node is listed as asuspicious node, the PWDQ model departs from previousmodels in that infected nodes will be recovered either bypassive benign worms or by quarantine measures. Computersimulations show that this method may decrease the numberof infectious nodes and reduce the speed of networkmalwarepropagation.

Omote and Shimoyama found a method for preventingthe spread of network malware [18]. An estimating unitcalculates the expected number of infected nodes when themalware transmits a predeterminednumber of packets, basedon the infectivity calculated by the infectivity calculating unit.

Bradley et al. [19] and other studies have shown that thenetwork topology has an impact on networkmalware spread-ing: the closer to the “center” of the network the malware is,the faster the malware spreads and the higher the probabilityof repeated infection is.

Gourdin et al. found that the effect of network malwarespreading in a telecommunication network [20], where acertain curing strategy is deployed, can be captured byepidemicmodels. In theirmodel, the probability of each nodebeing infected depends on the curing and infection rate of itsneighbors.

Tang and Li investigated malware spread in WirelessSensor Networks (WSNs) through Susceptible-Infective (SI)epidemic models [21] and proposed two adaptive networkprotection schemes for securing WSNs against malwareattacks.

Abaid et al. [22] proposed elastically partitioning networktraffic to enable distributing detection load across a range ofdetectors and making a centralized SDN controller, whichallows for network-wide threat correlation as well as quickcontrol of malicious flows.

Ichiro et al. mentioned that, in security incident response,the isolation of network virus-infected nodes and investi-gation of the damage situation of network virus activityare needed [23]. They proposed a method to isolate virus-infected nodes while avoiding being detected by malware bychanging network quickly and partially using SDN.

Security and Communication Networks 3

Hosseini et al. [24, 25] proposed a dynamic model ofmalware propagation in scale-free networks (SFNs) based ona rumor spreading model. The model considers the impactof software diversity to halt the outbreak of malware innetworks. Their research stated that the simulation resultsdemonstrate that the model is more effective than otherexistingmodels ofmalware propagation, in terms of reducingthe density of infected node.

These research efforts provide several new approaches forstudying network malware spreading and prevention in theSDN environment. In terms of our approach, we believe thatsince an SDN controller canmanage and quarantine nodes inthe entries network, when new network malware breaks outin a subnet, this controller may change the flow table strategyaccording to network status and prevent the spreading of themalware to other subnets. As such, we designed a networkmalware propagation model of SDN to effectively defendagainst the spreading of network malware.

3. Modeling Network Malware Spreading inan SDN Environment

As the spread of network malware in SDN is similar to thespread of diseases, we can use similar models to study thespread of network malware. This type of model has twoassumptions: (1) the state of a network node at any moment 𝑡is limited; the states include “susceptible”; “infected”; “recov-ery”; “isolation”. We can choose different sets of statesaccording to the characteristics of the network malware andmodeling purposes. (2) The infected nodes have a certainprobability of infecting other nodes in the network.

Our mathematical model of computer malware spreadis mostly based on the Susceptible-Infected-Recovery (SIR)model or the simple Susceptible-Infected-Susceptible (SIS)model [26]. To simplify our research, we adopted the SISmodel, where each node belongs to one of two states: sus-ceptible or infected [27, 28]. Mathematical analysis on such amodel has revealed the importance of topology for propaga-tion dynamics. Particularly, we found that the time-varyingcommunity network model is suitable for networks withsmall numbers of susceptible nodes, and we assumed that thenetwork evolves more slowly than the diffusion process.

3.1. Model Assumptions. Different nodes belong to differentsubnets in a computer network. In our study, we use logicalsubnets to classify the community network; networkmalwarespreads more quickly within the subnet and spreads slowlybetween different subnets. To simplify the complex model,we assume that the network malware cannot spread betweendifferent subnets in normal conditions. Because the SDNmaychange its routing strategy, when one infected node movesfrom one subnet to another logical subnet, it probably makesthe network malware spread between subnets.

To study the effects of network malware spreading whenan infected node changes from one subnet to another in SDN,we establish some simple model assumptions.

(1) Consider a total population of𝑁 nodes in the model,which means that no new nodes enter or leave the system atany time.

(2) In the model, nodes only have two possible states:susceptible (𝑆) and infected (𝐼). A node must be in one of thetwo states, and an infected node cannot be infected again.Wedefine the initial infected nodes as 𝑋(0) = 𝐼0.

(3)Thenetworkmalware cannot spread between differentsubnets in normal conditions, which means that there are noinfection paths between different subnets.

Assume that each susceptible neighbor of an infectednode has a probability 𝜆 of being infected and a susceptiblenode has 𝑘inf infected neighbors at time 𝑇 in the model. At𝑇 + 1 step, this susceptible node will become infected withprobability 1− (1−𝜆)𝑘inf . At the same time, the infected nodemay become susceptible at rate 𝜇 through network malwarekilling and patching.

3.2.Model withTime-VaryingCommunityNetwork. Althoughvarious studies have shown that a computer network is a“scale-free” network, to simplify the model, we begin ouranalysis with the simple time-varying community network.

Based on the model assumption, we construct a time-varying community network with network malware spread-ing.

(1)Consider a total population of𝑁 nodes that is dividedinto𝑚 subnets with random 𝑛𝑖 (𝑖 = 1, 2, . . . , 𝑚) nodes in eachsubnet, and let them satisfy

𝑚

∑𝑖=1

𝑛𝑖 = 𝑁. (1)

(2) For each subnet i, we use probability 𝑝𝑖 to add a linkbetween each two nodes and let them satisfy

𝑚

∑𝑖=1

𝑝𝑖 ⋅ 12𝑛𝑖 (𝑛𝑖 − 1) =𝑁 ⋅ ⟨𝑘⟩

2 . (2)

In addition, ⟨𝑘⟩ is the average degree of the entire network.(3) When an infected node jumps from one subnet into

another subnet, it will spread the network malware. Weassume that every node 𝑗 (𝑗 = 1, 2, . . . , 𝑁) has probabilityq to jump to another subnet, which is chosen randomly. Inorder to simulate malware spreading caused by node jump,we add links between different subnet with probability q.During each time step, break all of the links between differentsubnet connected at last time step.Then connect nodes in thedifferent subnet with probability q again.Themost importantvalue is a threshold 𝜆𝑐. The network malware spreads andbecomes infected for 𝜆 > 𝜆𝑐 and perishes for 𝜆 < 𝜆𝑐. Inthis model, we have a network malware threshold 𝜆𝑐. Thenetworkmalware spreads and becomes infectedwhen𝜆 > 𝜆𝑐.From the theory of probability [29], we have 𝜆𝑐 = 𝜇/⟨𝑘⟩ inthe time-varying community network model. For a specificcommunity 𝑖, when the mobility rate 𝑞 = 0, its networkmalware subthreshold is defined as

𝜆𝑖𝑐 = 𝜇⟨𝑘𝑖⟩ = 𝜇

𝑝𝑖 (𝑛𝑖 − 1) . (3)


The network malware in the specific community 𝑖 willsurvive when 𝜆 > 𝜆𝑖𝑐 and die for 𝜆 < 𝜆𝑖𝑐.We assume that thereis only one seed at the beginning, which means 𝑋(0) = 1.The networkmalware will spreadwithin the subnet where theseed is chosen and will not affect other subnets.

Because of the regular changes in the routing strategyin SDN, network nodes including mobile devices, networkdevices, and hosts can be redirected, which means that thenode mobility rate between subnets satisfies 𝑞 > 0. When𝜆 > 𝜆𝑖𝑐 (𝑖 = 1, 2, ..., 𝑚), even if there is only one seed at thebeginning, the network malware may spread into all of thesubnets. We discover that the time of the network malwareoutbreak in the subnets is dependent on the mobility rate𝑞. When 𝜆 < 𝜆𝑖𝑐 (𝑖 = 1, 2, ..., 𝑛; 𝑛 < 𝑚), a mobility ratethreshold 𝑞𝑐 is considered. The network malware in subnetis 𝑖 where 𝜆 < 𝜆𝑖𝑐 can survive when 𝑞 > 𝑞𝑐 because of thejump of infected nodes.

4. Simulation and Evaluation

To simulate the network malware spreading, we use a similarexperimental environment. To be brief we set 𝑚 = 2 andanalyze the network malware spreading in two cases. At thebeginning, there is only one infected node,𝑋(0) = 1, and weset 𝑁 = 3000, 𝑛1 = 1200, 𝑛2 = 1800, ⟨𝑘⟩ = 20, 𝑝1 = 0.0069,and 𝑝2 = 0.0155. These parameters satisfy (1) and (2).

(A) 𝜆 > 𝜆𝑖𝑐 (𝑖 = 1, 2). Let us set 𝜇 = 0.1. We can obtain 𝜆1𝑐 =0.0121 and 𝜆2𝑐 = 0.0036 from (3). We set 𝜆 = 0.02 > 𝜆𝑖𝑐 (𝑖 =1, 2).In the simulation, we chose an infected node in the first

subnet randomly, and the other nodes in the two subnetswere susceptible. We simulate the step with mobility rate𝑞 = 0.000001 to 0.00001 between the subnets, and the resultis shown in Figure 1.The curve with black asterisks representsthe density of infected nodes in the first subnet as a functionof time with mobility rate 𝑞 = 0.00001 and the other curvesrepresent the evolution of infected nodes in the second subnetwith different mobility rates from 0.00001 to 0.000001.

As can be observed from the diagram, the networkmalware first broke out in the first subnet and then propa-gated into the second subnet. The time of network malwareoutbreak in the second subnet decreased with the increase inthe mobility rate 𝑞.

We have not plotted the curve of the other mobility ratein the first subnet because the network malware spreadingin the first subnet has less of a relationship with 𝑞. Thevalues of mobility rate 𝑞 applied above were chosen basedon experiment and by experience. A deep understanding ofthe detailed time evolution of networkmalware spreading is aprerequisite to finding optimal strategies to prevent networkmalware outbreaks. Thus, we analyzed it in detail.

From the simulation, we knew that when 𝜆 > 𝜆2𝑐, thenetwork malware would have an outbreak in the secondsubnet only if there was one node that was infected by thenodes and had moved from the first subnet.

At each time step, the number of infected nodes thatmovefrom the first subnet can be calculated as 𝑛1𝑞𝜌1(𝑡), where 𝜌1(𝑡)

20 40 60 800 100t (time step)

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

𝜌(t)

(1), q = 0.00001

(2), q = 0.00001

(2), q = 0.000002

(2), q = 0.000001

Figure 1: Density of infected nodes 𝜌(𝑡) in two subnets withdifferent mobility rates 𝑞. The symbol (1) denotes the first subnet,and the symbol (2) denotes the second subnet.

represents the density of the infected nodes in the first subnetat time t, q is the mobility rate between subnets, and 𝑛1 is thetotal number of nodes of the first subnet.

In the time-varying network model, small world model,and scale-free model, these theories are based on meanfield theory. According to mean field theory, 𝜌1(𝑡) satisfiesequation 𝜌1(𝑡) = −𝜇𝜌1(𝑡) + 𝜆⟨𝑘1⟩𝜌1(𝑡)(1 − 𝜌1(𝑡)).

In this equation, 𝜌1(𝑡) represents the density of theinfected nodes in the first subnet and each infected nodewill become susceptible at rate 𝜇. 𝜆 is the probability thateach susceptible node linked by an infected node will beinfected. On the right side of the equation, −𝜇𝜌1(𝑡) shows thereduced number of infected nodes, (1 − 𝜌1(𝑡)) is the densityof susceptible nodes, and ⟨𝑘1⟩𝜌1(𝑡) presents the numberof infected nodes around a susceptible node. According tothe multiplication rule, 𝜆⟨𝑘1⟩𝜌1(𝑡)(1 − 𝜌1(𝑡)) presents theincreased number of infected nodes in the entire network.The simplified formula is

𝜌1 (𝑡) = 𝑎/𝑏1 + 𝑐𝑒−𝑎𝑡 , (4)

where 𝑎 = 𝜆⟨𝑘1⟩ − 𝜇, 𝑏 = 𝜆⟨𝑘1⟩, and

𝑐 = 𝑎 − 𝜌1 (0) 𝑏𝜌1 (0) 𝑏 . (5)

𝜌1(0) shows the density of infected nodes at time 𝑡 = 0,and, in this simple example, we obtain 𝜌1(0) = 1/𝑛1. At timestep 𝑡, there are 𝑛1𝜌1(𝑡) infected nodes in the first subnet.According tomodel, the nodes between subnets connect withprobability 𝑞. So, in the second subnet, there are 𝑛1𝜌1(𝑡)𝑛2𝑞nodes connected with the infected nodes in the first subnet,which have a probability 𝜆 of being infected. So, at each timestep 𝑡, the probability of the node in the second subnet being


infected is 𝑛1𝜌1(𝑡)𝑛2𝑞𝜆. Supposing that the probability of thenode in the second subnet being infected at 𝑡𝑐 time step is100%, we can write the formula as

∫𝑡𝑐

0𝑛1𝜌1 (𝑡) 𝑛2𝑞𝜆 𝑑𝑡 = 1. (6)

Then, we can obtain

𝑡𝑐 =ln (𝑒ln(1+𝑐)+𝑏/(𝜆𝑛1𝑛2𝑞) − 𝑐)

𝑎 . (7)

We can obtain the outbreak time of the network malwarein the second subnet by

𝑇𝑐 = 𝑡𝑐 + 𝑡0 =ln (𝑒ln(1+𝑐)+𝑏/(𝜆𝑛1𝑛2𝑞) − 𝑐)

𝑎 + ln 𝑐𝑎 . (8)

In this formula, 𝑡0 = ln 𝑐/𝑎 is the time for the numberof infected nodes in the second subnet to increase from oneto half of the stabilized value. To check the above theoreticalanalysis, we simulate experiments to obtain test data. Wemake numerical experiments and determine 𝑇𝑐 by checkingthe number of infected nodes of the second subnet, whichreaches half of the stabilized value at time step 𝑇𝑐. We buildthe time-varying networkwith the same parameters as shownin Figure 1 and set 𝜆 = 0.02 and 𝜆 = 0.08. We simulatethe experiment many times and take the average result ofseveral experiments. When we change the mobility rate 𝑞from 0.000001 to 0.00001, we obtain two curves, as shown inFigure 2.The circles and asterisks denote the results from twodifferent 𝜆 values by experiment, and the two lines representthe results calculated from (8), where 𝜆 = 0.02 and 𝜆 = 0.08.As we can see, the numerical simulations and theoreticalconclusion are consistent.

(B) 𝜆2𝑐 < 𝜆 < 𝜆1𝑐. Through our analysis, we know that thenetwork malware will perish in the first subnet, where themobility rate 𝑞 is too low. However, if the mobility rate ishigh enough, the network malware may also spread into thesecond subnet.

In the experiments, we select 𝜆 = 0.008 and use the samevalues of the other parameters of the time-varying network,as in Figure 1. The value conforms to 𝜆2𝑐 < 𝜆 < 𝜆1𝑐, and weuse the initial value of infected nodes 𝑋(0) = 100, whichis selected randomly from the first subnet. We get the values𝜌1(0) = 𝑋(0)/𝑛1 = 0.083, 𝜌2(0) = 0, and 𝜌(0) = 𝑋(0)/𝑁 =0.033, where 𝜌1(0), 𝜌2(0), and 𝜌(0) represent the density ofinfected nodes in the first subnet, second subnet, and entirenetwork, respectively.

Figures 3(a) and 3(b) show the evolution function curveof 𝜌(𝑡) in two subnets with the mobility rates 𝑞 = 0.0001and 𝑞 = 0.00001. The black asterisks represent the densityof infected nodes in the first subnet as a function of time, andthe red circles represent the evolution of infected nodes inthe second subnet. As indicated in Figure 3(a), the networkmalware broke out at 𝑡 = 70 approximately for 𝑞 = 0.0001 inthe second subnet. However, for 𝑞 = 0.00001, the number ofinfected nodes was reduced to zero slowly in the first subnet

Theoretical curve

×10−50.2 0.4 0.6 0.8 1 1.20

q

20

30

40

50

60

70

80

Tc(q)

𝜆 = 0.02

𝜆 = 0.08

Figure 2:Thenetworkmalware outbreak time𝑇𝑐 versus themobilityrate 𝑞. The symbols represent the results of numerical simulations,and the lines represent the results of theory.

and the networkmalware did not break out at all in the secondsubnet, as shown in Figure 3(b).

We theoretically analyze how the mobility rate influencesthe spreading of network malware. Because 𝜆 < 𝜆1𝑐, theremust be a time step 𝑡1 when the network malware will perishwhen 𝑡 = 𝑡1 in the first subnet. The network malware canspread in the second subnet only if the infected nodes canmove into the second subnet and at least one susceptible nodein the second subnet is infected before 𝑡 = 𝑡1. According to(4), we know that when 𝑎 < 0, 𝜌1(𝑡) is reduced gradually toclose to zero. We use 𝜌1(𝑡1) = 0.0001 as a small number andsolve (4) to obtain 𝑡1:

𝑡1 = ln ((10000𝑎 − 𝑏) /𝑏𝑐)−𝑎 . (9)

From (7) and (9) and considering 𝑡1 = 𝑡 when 𝑞 = 𝑞𝑐, wedefine 𝑐 as in (5) and obtain

𝑞𝑐 = 𝑏𝑛1𝑛2 (ln (𝑏𝑐/ (10000𝑎 − 𝑏) + 𝑐) − ln (1 + 𝑐)) . (10)

To simulate the process better, we repeated the exper-iments several times and set 𝑋(0) = 100 to 200 and set𝜆 = 0.004 to 0.01, and then the mobility rate 𝑞 is graduallyincreased from 0. When the mobility rate 𝑞 increases tothe threshold 𝑞𝑐, the network malware will break out in thesecond subnet. For each set of 𝑋(0) and 𝜆, we conductedthe experiment 100 times and averaged the test data. Asshown in Figure 4, the circles and asterisks indicate theexperiment results for 𝑋(0) = 100 and 200, respectively. Thelines represent the theoretical value calculated from (10) andshow that, for a specific 𝜆, the mobility rate threshold 𝑞𝑐 isapproximately inversely proportional to 𝑋(0), which is theinitial number of infected nodes in the first subnet. However,


First communitySecond community

0

0.05

0.1

0.15

0.2

0.25

0.3

0.35𝜌(t)

50 100 150 2000t (time step)

(a)

First communitySecond community

50 100 150 2000t (time step)

0

0.005

0.01

0.015

0.02

0.025

0.03

0.035

𝜌(t)

(b)

Figure 3: Density of infected nodes 𝜌(𝑡) as a function of 𝑡 in two subnets with 𝜆 = 0.008. (a) 𝑞 = 0.0001. (b) 𝑞 = 0.00001.

qc

×10−3

×10−4

Theoretical curve

x(0) = 200

x(0) = 100

5 6 7 8 9 104𝜆

0

0.2

0.4

0.6

0.8

1

Figure 4: The mobility rate threshold 𝑞𝑐 versus the infection rate 𝜆with different initial numbers of infected nodes.

for a specific 𝑋(0), 𝑞𝑐 rapidly decreases with the increasein the infection rate 𝜆. For example, when 𝑋(0) = 100, 𝑞𝑐decreases from 8.2 ∗ 10−5 to 1.2 × 10−5 as 𝜆 increases from0.004 to 0.01. The numerical simulation results confirm thetheoretical formula in (10).

Some researchers [30, 31] have conducted studies on theimpact of community structure on SIS epidemic spreadingprocess and these research results provide us with a newidea of studying time-varying community structure of thefield of network security. On the basis of the simulation

experiments, we proved the effectiveness of ourmodel to findthe propagation threshold of network community. This maybe helpful to evaluating the network malware outbreak timein SDN.

5. Possible Applications

With SDN redefining the traditional networking businessmodel, customers can easily discover, learn, and get specificnetwork applications and download them to their ownenvironment. Conversely, malware will easily spread in thewhole network. Specifically, our research may be useful atmalware propagation and prevention within SDN in thefollowing ways.

Firstly, by the analysis we can get the mobility ratethreshold 𝑞𝑐 of the malware propagation and when thereare some new and large-scale malware outbreaks, throughsome measures (such as firewall, access control), the respec-tive national information security center (e.g., the nationalComputer Emergency Response Team (CERT)) may provideSDN-based network security for data centers and assets,detectingmalware propagation and insider attacks at an earlystage.The security center can decide the SDN control strategyto reduce the spread and the possibility of outbreak of themalware.

Secondly, in the face of a highly globalized businessenvironment, many companies are eager to transform theirnetwork architectures into ones which are easy to control andadjust; SDN applications make this aspiration possible. Ourmodel can help the companies’ administrator(s) to modifythe network routing policy to reduce and prevent the spreadof the network malware.

Finally, a potential SDN-based “App” approach (recentlyintroduced by HP and Huawei) offers a platform for cus-tomers to see real, high-value use cases of SDN that can


benefit their organization. Customers can easily access anddeploy innovative solutions to solve real business problemsthat legacy infrastructures cannot and gain the complete vis-ibility and control only IP Address Management can provide.When they get the information of emerging malware, theycan adjust their strategies to avoid their own resources bymalware propagation.

6. Conclusion and Perspectives

This research proposes a network model with time-varyingcommunity structures in an SDN environment. A model wasdesigned to analyze network malware spreading and preven-tion under SDN architecture. In our model, connections arestatic within subnets and are dynamic between subnets. Theimpact of the mobility rate 𝑞 on network malware spreadingis studied. It is found that when nodes infected with networkmalware move from the source subnet to the target subnet,the network malware would break out in the target subnet inwhich there exists no infected node initially, and the outbreaktime decreases with increasing mobility rate.

We have also found that there exists a mobility ratethreshold 𝑞𝑐. The network malware breaks out when themobility rate is larger than the threshold value and dies whenthe mobility rate is smaller than the threshold value in all ofthe subnets.

The control plane of SDNs enables us to adjust themanagement strategy of the entire network [32]. Our resultsmay be helpful in evaluating the network malware outbreaktime in a subnet that contacts other infected subnets froma global perspective. We can now isolate suspected infectednodes dynamically, control the mobility rate of subnets, andmodify the network routing policy to reduce and prevent thespread of the network malware.

In terms of future work, we plan to analyze the networkmalware spreading and protection in a scale-free networkmodel in an SDN environment because a scale-free networkis more similar to a computer network. Increasingly, we findthat emerging groups of researchers are starting to work onsimilar research areas, showing the validity and urgency ofour work. Further improvements can bemade, as our study isonly beginning and its theoretical model is relatively simple;effort to make our study align closer to real-life networkenvironments in large deployments is a critical direction.From a theoretical analysis viewpoint, the degree of nodesis different in scale-free networks, their mobility rate effectson the spread of computer malware are also different, andthe mobility of center nodes will have more influence on thespread of computer malware. We will study the network mal-ware spreading and protection in a scale-free network modeland analyze the relationship between the node mobility rateand spread of networkmalware in thismodel.Thismodel willbemore complicated and ourworkwill beginwith simulationexperiments.

Conflicts of Interest

The authors declare that they have no conflicts of interest.

Acknowledgments

This research is supported by the National Natural ScienceFoundation of China (no. 61571141), the Guangdong ProvinceTeaching Quality Project ([2015] no. 133)-Network Engineer-ing Comprehensive Reform, and the Guangdong ProvincialApplication Oriented Technical Research and DevelopmentSpecial Fund Project (2015B010131017). This research is alsosupported by the New Zealand Office of the Privacy Com-missioner and STRATUS (https://stratus.org.nz).

References

[1] C. Yoon, T. Park, S. Lee, H. Kang, S. Shin, and Z. Zhang, “Enabl-ing security functions with SDN: a feasibility study,” ComputerNetworks, vol. 85, pp. 19–35, 2015.

[2] J. Francois, L. Dolberg, O. Festor, and T. Engel, “Networksecurity through software defined networking: a survey,” inProceedings of the Conference on Principles, Systems and Appli-cations of IP Telecommunications (IPTComm ’14), pp. 1–8, ACM,Chicago, Ill, USA, 2014.

[3] S. T. Ali, V. Sivaraman, A. Radford, and S. Jha, “A survey ofsecuring networks using software defined networking,” IEEETransactions on Reliability, vol. 64, no. 3, pp. 1086–1097, 2015.

[4] G. Carrozza, V. Manetti, A. Marotta et al., “Exploiting SDNapproach to tackle cloud computing security issues in theATC scenario,” in Dependable Computing, pp. 54–60, Springer,Berlin, Germany, 2013.

[5] H. Zhou, C. Wu, M. Jiang et al., “Evolving defense mechanismfor future network security,” IEEE Communications Magazine,vol. 53, no. 4, pp. 45–51, 2015.

[6] H. Kim and N. Feamster, “Improving network managementwith software defined networking,” IEEECommunicationsMag-azine, vol. 51, no. 2, pp. 114–119, 2013.

[7] C. Fu,M. Li, Y. Zhang, D. Zou, and L. Han, “A hierarchical virusimmunization method for community networks,” China Com-munications, vol. 11, no. 9, pp. 148–159, 2014.

[8] T. Lu, K. Zheng, R. Fu, Y. Liu, B. Wu, and S. Guo, “A dangertheory based mobile virus detection model and its applicationin inhibiting virus,” Journal of Networks, vol. 7, no. 8, pp. 1227–1232, 2012.

[9] S. Yu, G. Gu, A. Barnawi, S. Guo, and I. Stojmenovic, “Malwarepropagation in large-scale networks,” IEEE Transactions onKnowledge andData Engineering, vol. 27, no. 1, pp. 170–179, 2015.

[10] A. Hellal and L. Ben Romdhane, “Minimal contrast frequentpattern mining for malware detection,” Computers & Security,vol. 62, pp. 19–32, 2016.

[11] N. Kheir and C. Wolley, “BotSuer: suing stealthy P2P Bots innetwork traffic through netflow analysis,” in Cryptology andNetwork Security, vol. 8257 ofLectureNotes inComputer Science,pp. 162–178, Springer, Cham, Switzerland, 2013.

[12] M. Ali and A. B. M. Said, “Securing cloud infrastructure usingbayesian predictive analysis against unrecognized malware,”in Proceedings of the 1st International Conference on ModernCommunication & Computing Technologies, 2014.

[13] H. Guo, H. K. Cheng, and K. Kelley, “Impact of network struc-ture onmalware propagation: a growth curve perspective,” Jour-nal of Management Information Systems, vol. 33, no. 1, pp. 296–325, 2016.

[14] L. Feng, X. Liao, Q. Han, and H. Li, “Dynamical analysis andcontrol strategies on malware propagation model,” AppliedMathematical Modelling, vol. 37, no. 16-17, pp. 8225–8236, 2013.

https://stratus.org.nz


[15] M. Benaım and J.-Y. Le Boudec, “A class of mean field inter-action models for computer and communication systems,” Per-formance Evaluation, vol. 65, no. 11-12, pp. 823–838, 2008.

[16] A. Y. Ding, J. Crowcroft, S. Tarkoma, and H. Flinck, “Softwaredefined networking for security enhancement in wireless mob-ile networks,” Computer Networks, vol. 66, pp. 94–101, 2014.

[17] O. Toutonji and S.-M. Yoo, “Passive benign worm propagationmodeling with dynamic quarantine defense,” KSII Transactionson Internet and Information Systems, vol. 3, no. 1, pp. 96–107,2009.

[18] K. Omote and T. Shimoyama, “Anti-worm-measure parameterdetermining apparatus, number-of-nodes determining appara-tus, number-of-nodes limiting system, and computer product,”US, US7926110[P], 2011.

[19] J. T. Bradley, S. T. Gilmore, and J. Hillston, “Analysing dis-tributed Internet worm attacks using continuous state-spaceapproximation of process algebra models,” Journal of Computerand System Sciences, vol. 74, no. 6, pp. 1013–1032, 2008.

[20] E. Gourdin, J. Omic, and P. Van Mieghem, “Optimization ofnetwork protection against virus spread,” in Proceedings of the8th International Workshop on the Design of Reliable Com-munication Networks (DRCN ’11), pp. 86–93, Krakow, Poland,October 2011.

[21] S. Tang and W. Li, “An epidemic model with adaptive virusspread control for Wireless Sensor Networks,” InternationalJournal of Security and Networks, vol. 6, no. 4, pp. 201–210, 2011.

[22] Z. Abaid, M. Rezvani, and S. Jha, “MalwareMonitor: an SDN-based framework for securing large networks ,” in Proceedingsof the 2014 CoNEXT on Student Workshop (CoNEXT StudentWorkshop ’14), pp. 40–42, Sydney, Australia, 2014.

[23] K. Ichiro, K. Satoshi, K. Takeyasu et al., “Method for networkswitching to support investigation of malware with SDN,” IpsjSig Technical Reports, vol. 2014, pp. 1–8, 2014.

[24] S. Hosseini and M. A. Azgomi, “A model for malware propaga-tion in scale-free networks based on rumor spreading process,”Computer Networks, vol. 108, pp. 97–107, 2016.

[25] S.Hosseini,M.A.Azgomi, andA. T. Rahmani, “Malware propa-gation modeling considering software diversity and immuniza-tion,” Journal of Computational Science, vol. 13, pp. 49–67, 2016.

[26] L. Pellis, F. Ball, S. Bansal et al., “Eight challenges for networkepidemic models,” Epidemics, vol. 10, pp. 58–62, 2015.

[27] R. M. Anderson and R. M. May, Infectious Diseases in Humans,Oxford University Press, Oxford, UK, 1992.

[28] J. C. Wierman and D. J. Marchette, “Modeling computer virusprevalence with a susceptible-infected-susceptible model withreintroduction,”Computational Statistics andDataAnalysis, vol.45, no. 1, pp. 3–23, 2004.

[29] J. Marro and R. Dickman, Nonequilibrium Phase Transitions inLattice Models, Cambridge University Press, Cambridge, UK,1999.

[30] Z. Liu and B. Hu, “Epidemic spreading in community net-works,” Europhysics Letters, vol. 72, no. 2, pp. 315–321, 2005.

[31] J. Chen, H. Zhang, Z.-H. Guan, and T. Li, “Epidemic spreadingon networks with overlapping community structure,” PhysicaA: Statistical Mechanics and Its Applications, vol. 391, no. 4, pp.1848–1854, 2012.

[32] Y. Sung, P. Sharma, E. Lopez, and J. Park, “FS-OpenSecurity:a taxonomic modeling of security threats in SDN for futuresustainable computing,” Sustainability, vol. 8, no. 9, article 919,2016.

RoboticsJournal of

Hindawi Publishing Corporationhttp://www.hindawi.com Volume 2014


Active and Passive Electronic Components

Control Scienceand Engineering

Journal of


International Journal of

RotatingMachinery


Hindawi Publishing Corporation http://www.hindawi.com

Journal of

Volume 201

Submit your manuscripts athttps://www.hindawi.com

VLSI Design



Shock and Vibration


Civil EngineeringAdvances in

Acoustics and VibrationAdvances in



Electrical and Computer Engineering

Journal of

Advances inOptoElectronics

Hindawi Publishing Corporation http://www.hindawi.com

Volume 2014

The Scientific World JournalHindawi Publishing Corporation http://www.hindawi.com Volume 2014

SensorsJournal of


Modelling & Simulation in EngineeringHindawi Publishing Corporation http://www.hindawi.com Volume 2014


Chemical EngineeringInternational Journal of Antennas and

Propagation




Navigation and Observation



DistributedSensor Networks


Documents

Malware Propagation and Prevention Model for Time-Varying ...downloads.hindawi.com/journals/scn/2017/2910310.pdf · Tang and Li investigated malware spread in Wireless SensorNetworks(WSNs)throughSusceptible-Infective(SI)