文献类型：期刊文献

英文题名：Modeling social worm propagation for advanced persistent threats

作者：Zhou, Peng[1];Gu, Xiaojing[2];Nepal, Surya[3];Zhou, Jianying[4]

机构：[1]Shanghai Univ, Shanghai, Peoples R China;[2]East China Univ Sci & Technol, Shanghai, Peoples R China;[3]CSIRO, Data61, Canberra, ACT, Australia;[4]Singapore Univ Technol & Design, Singapore, Singapore

年份：2021

卷号：108

外文期刊名：COMPUTERS & SECURITY

收录：;EI(收录号：20212510530748);WOS:【SCI-EXPANDED(收录号:WOS:000681264400018)】；

基金：This work was partially supported by grants from the National Natural Science Foundation of China with number 61972452 and 61633016 , the Natural Science Foundation of Shanghai with number 18ZR1415000, and the 111 project with number D18003.

语种：英文

外文关键词：Social worm; Propagation model; Advanced persistent threat; Worm propagation; Targeted intrusion

摘要：Modem social worms have been evolving from mass propagation (i.e., blind social worm) to targeted intrusion with the purpose of advanced persistent threats (or APT in short), which concern more on attacking a small number of selected social targets with stealthy propagation (to avoid early exposure caused by a large population of infections), usually at the cost of slow infection speed and thus suffering a long-term propagation period. The resulted propagation characteristics are therefore very different compared to mass infections and cannot be well captured by existing propagation models. In this paper, we take the first step to model social worm propagation for the APT using a novel proactive give-up factor , by which the worm can consult to actively postpone or stop unnecessary infections in order to keep the propagation stealthy (inversely in terms of the size of infected population) and long-term (in terms of the number of infection time epochs), meanwhile maintaining the reachability to the targets (in terms of the connectivity from sources to targets). Our basic idea is to derive such a factor for each node as a give-up probability or a delayed value according to the node's relative location with respect to sources and targets. We note new infections may lead the relative locations for each node vary, and accordingly model the factor updating upon the propagation progress. To validate our design, we have conducted rigorous theoretical analysis, as well as extensive experiments by running simulated APT worms over the real-world social network topologies. The results have successfully confirmed the effectiveness of our model in simulating APT worm's propagation with targeted, stealthy and long-term properties altogether. (c) 2021 Elsevier Ltd. All rights reserved.