Visible to the public "WAP: Models and metrics for the assessment of critical-infrastructure-targeted malware campaigns"Conflict Detection Enabled

Title"WAP: Models and metrics for the assessment of critical-infrastructure-targeted malware campaigns"
Publication TypeConference Paper
Year of Publication2015
AuthorsM. Grottke, A. Avritzer, D. S. Menasché, J. Alonso, L. Aguiar, S. G. Alvarez
Conference Name2015 IEEE 26th International Symposium on Software Reliability Engineering (ISSRE)
Date PublishedNov
ISBN Number978-1-5090-0406-5
Accession Number15704630
Keywordsadvanced persistent threat, advanced persistent threats, Analytical models, contagion probability, coordinated massive malware campaign assessment, critical infrastructure protection, critical infrastructure sectors, critical infrastructures, early malware detection, false negatives, false positives, four-node topology, infection probability, invasive software, Malware, malware infections, Markov models, Mathematical model, Network topology, probability, pubcrawl170101, quarantine, rejuvenation, scanning nodes, security, security community, soft impacts, Steady-state, survivability, system survivability, Topology, WAP

Ensuring system survivability in the wake of advanced persistent threats is a big challenge that the security community is facing to ensure critical infrastructure protection. In this paper, we define metrics and models for the assessment of coordinated massive malware campaigns targeting critical infrastructure sectors. First, we develop an analytical model that allows us to capture the effect of neighborhood on different metrics (infection probability and contagion probability). Then, we assess the impact of putting operational but possibly infected nodes into quarantine. Finally, we study the implications of scanning nodes for early detection of malware (e.g., worms), accounting for false positives and false negatives. Evaluating our methodology using a small four-node topology, we find that malware infections can be effectively contained by using quarantine and appropriate rates of scanning for soft impacts.

Citation Key7381826