Quantitative model to measure the spread of Security attacks in Computer Networks

Transcription

1 Quantitative model to measure the spread of Security attacks in Computer Networks SAURABH BARANWAL M.Sc.(Int.) 4 th year Mathematics and Sci. Computing Indian Institute of Technology, Kanpur saurabhbrn@gmail.com, baranwal@iitk.ac.in Project Guide Dr. N Raghu Kisore Assistant Professor IDRBT, Hyderabad INSTITUTE OF DEVELOPMENT AND RESEARCH IN BANKING TECHNOLOGY (IDRBT) ROAD NO. 1, CASTLE HILLS, MASAB TANK, HYDERABAD

2 CERTIFICATE This is to certify that Mr. Saurabh Baranwal, pursuing M.Sc.(Int.) course at Indian Institute of Technology, Kanpur in the School of Mathematics and Scientific Computing has undertaken a project as an intern at IDRBT, Hyderabad from May 8, 2013 to July 7, He was assigned the project Quantitative model to measure the spread of security attacks in Computer Networks under my guidance. During the course of the project he has undertaken a study of Mathematical Modelling and Security in Computer Networks and also has done excellent work. I wish him all the best for all his endeavours. Dr. N Raghu Kisore (Project Guide) Assistant Professor IDRBT, Hyderabad

3 Acknowledgment I express my deep sense of gratitude to my Guide Dr. N Raghu Kisore, Assistant Professor, IDRBT for giving me an opportunity to do this project in the Institute for development and research in Banking Technology and providing all the support and guidance needed which made me complete the project on time. I am also thankful to Mathematics and Scientific Computing, Indian Institute of Technology, Kanpur for giving me this golden opportunity to work in a high-end research institute like IDRBT. Saurabh Baranwal M.Sc.(Int.) 4 th year Mathematics and Sci. Computing Indian Institute of Technology, Kanpur

4 Abstract The objective of the proposed work is to build mathematical model to measure the financial losses due to a security attack on a computer network. A digitalized economy depends on internet for all of its services. One of these services is maintaining digital currency and transfer of the same between a creditor and debtor (payments). This involves building of secure payment protocols based on strong mathematical proofs. But in reality the success of such a system is limited by trust of the end user. That is the end system is only as successful as the security of the software realization of the cryptographic protocols. The propagation of fake currency in a physical society is largely restricted by logistics and hence the impact on the overall economy is limited. But in case of financial services like delivery and management of digital currency, infusion of fake currency into the network is subject to the security of the system. Further it is well understood that in spite of the best efforts to secure a piece of software, there is a non-zero probability of a security breach. The impact of a security breach is further magnified in a digital world due to the higher level of interconnections between systems. Hence the spread of fake currency in the event of a security or cyber attack grows exponentially. This work delivers a model that can be used to measure the number of nodes that will be attacked in the event of a cyber attack.

5 1 Introduction Propagation of computer virus is of great threat in the Internet generation, and is a serious problem in our highly information oriented society. For secure and reliable computer/communication network systems, it is an important issue to counter the propagation of computer virus. The computer virus is one of thousands of programs that can invade computer systems, and it may execute a variety of malicious activities, such as deletion files, destruction of hard disk and transmission of system information. Nowa-day, the computer virus can be classified into three types: Viruses, Worms and Trojan horses. In recent years, as a variety of services are available for many users on Internet, the damage of worms propagating via Internet, is drastically spreading. In general, the Internet worm is a self-propagation program and can propagate through the Internet services such as and Web. In other words, the Internet worm possesses the strong force of propagation. Hence the quantitative evaluation of Internet worm propagation is regarded as a major topic in network security problems. The most vivid example is the Code-Red worm which has explosively increased. On July 2001, the Code Red worm infected more than 359,000 hosts on the Internet within only 14 hours. The experience by explosive propagation of Code-Red worm motivates both network administrators and users to control and counter the Internet worms. In order to control and counter the propagation of computer viruses and Internet worms, considerable attention has been paid to examine the behaviour of virus and worm for recent years. Then the mathematical epidemic models are often used to represent the propagation of virus and worm. We will discuss some of the mathematical models in the next sections. Generally speaking, there are two main research directions: security issue and measurement. The objectives of security issue are, in short, to develop the security system which controls and counters the propagation of computer virus for reduction of its damage. Chen and Ranka[1] discuss the early warning system where the worm attack can be detected by a propagation model. On the other hand, for purposes of measurement, several virus and worm propagation models are proposed, which are based on the existing epidemic models.

6 2 Deterministic Models Various models have been used in the field of epidemiology. SIS and SIR models are the most prominent ones. These models are deterministic models and are valid only in case of sufficiently large populations. The transition rates from one class to another are mathematically expressed as derivatives, hence the model is formulated using differential equations. While building such models, it must be assumed that the population size in a compartment is differentiable with respect to time and that the epidemic process is deterministic. 2.1 SIS Model By using epidemic theory we can model worm propagation. The representative deterministic model is susceptible/vulnerable-infected-susceptible/vulnerable (SIS) model. In the deterministic SIS model, it is assumed that the Internet worm propagates in vulnerable computer hosts, and that the host from which the Internet worm is removed is still vulnerable. Let s(t) and v(t) denote the deterministic numbers of vulnerable and worm-infected hosts, respectively. Then the dynamics on the numbers of vulnerable and worm-infected hosts in the network can be described by dv(t) dt = βs(t)v(t) δv(t) ds(t) dt = βs(t)v(t) + δv(t) where β(> 0) and δ(> 0) are the infection rate and removal rate respectively. Assuming that the total number of hosts is given by a finite constant K = s(t) + v(t), the number of infections follows the logistic model: dv(t) dt = {δ(r 0 1) βv(t)}v(t) where R 0 = βk δ. 2.2 KS Model The SIS model is a simple epidemic model to characterize the propagation of computer virus, but cannot take account of the immunity to computer virus. The model with the framework of immunity is often called the susceptibleinfected-removed/immune-susceptible(sirs) model. In the computer virus prevalence, Kephart and White introduce the concept of kill signal(ks),

7 which is regarded as a warning for propagation of computer virus. Let v(t) and w(t) denote the number of infected and non-vulnerable hosts at time t, respectively. Then the dynamics of the infected and nonvulnerable hosts are described by the following differential equations: d dt v(t) = {Kβ δ (β + β r)w(t) βv(t)}v(t) d dt v(t) = {Kβ r δ r β r w(t) βw(t)}w(t) + δv(t) where K is the total number of hosts in the network, β is the propagation rate of computer virus, δ is the removal rate of computer virus, β r is the KS-spreading rate and δ r is the re-vulnerability rate. 3 Stochastic Models But in case the population is small or when parameters like the infection rates are transient in nature stochastic models are preferable. Stochastic epidemic models are described by birth and death processes which have specific state transitions. Dissimilar to deterministic models, stochastic models describe the probabilistic behaviour of virus propagation using probability mass functions for Markov states, and can represent rare events such as virus extinction. These models have an absorption state where number of infected nodes is zero. That is they assume that a virus attack eventually gets terminated with a probability of 1. Most of the published work build stochastic SIS and SIR models based on Markovian arrival process (MAP). MAP is a counting process whose arrival rate is governed by a Continuous Time Markov Chain (CTMC). The number of infected hosts is represented by a Continuous Time Markov chain (CTMC). Some of the measurements made by a stochastic model are: the basic reproduction number the probability of virus extinction the mean time to virus hazard the mean time to virus extinction In each of the above cases the most important metric that defines the ability of an infection to spread is the reproduction number, R. The following inferences can be made from value of reproduction number, R

8 1 indicates the whole process converges to disease free state. > 1 indicates the infection to b e epidemic in nature and infection would spread until there is no more susceptible population. 3.1 Stochastic SIS model In the stochastic modelling, dynamics of propagation can be modelled by a birth-and-death process. Especially, the stochastic SIS model is introduced from the classical epidemic theory to analyze worm propagation. If there are K computer hosts in the network, the worm propagation is given by the birth-and-death process with the following birth and death rates: λ i = β(k i)i, i = 0, 1, 2..., K µ i = δi, i = 0, 1, 2..., K where β(> 0) and δ(> 0) are the propagation rate of worm and the removal rate of infected worm respectively. Note that the birth rate λ i depends on the number of both worm-infected and vulnerable hosts in the network. Also in the stochastic SIS model, it is assumed that the host from which a worm is removed is still vulnerable. Let a stochastic process {V (t) : t 0} be the number of worm-infected hosts at time t, and p v (t), v = 0,..., K denote the probabilities that there are v worm-infected hosts in the network at time t. Based on the analysis technique of CTMC, the probabilities are given by the following: 1 dt p 0(t) = µ 1 p 1 (t) 1 dt p 1(t) = µ 2 p 2 (t) (λ 1 + µ 1 )p 1 (t) 1 dt p i(t) = λ v 1 p v 1 (t) (λ v + µ v )p 1 (t) + µ v+1 p v+1 (t) 1 dt p i(t) = λ v 1 p v 1 (t) (λ v + µ v )p 1 (t) + µ v+1 p v+1 (t) 1 dt p K(t) = λ K 1 p K 1 (t) µ K p K (t) Solving above equations by using numerical methods such as the Runge- Kutta method, we can investigate the stochastic behaviour of infection. Unlike deterministic models, the number of worm-infected hosts almost surely goes to zero because the state where all the worms are combated is an absorbing state. In other words, extinction of worm always occurs in the stochastic SIS model. This viewpoint provides a remarkable difference between deterministic and stochastic models.

9 3.2 Stochastic Kill Signal Model Define the stochastic processes V (t) and W (t) which are the number of worm-infected and non-vulnerable hosts at time t, respectively. We consider the CTMC with the state (V (t), W (t)) = (v, w). Then the transition rates at the state (v, w) can be described as follows: 1. Worms are propagating to the other vulnerable hosts, so that the transition rate to state (v + 1, m) is given by λ v,w = βv(k v w) 2. When worms are removed from hosts, the hosts become non-vulnerable. Hence, the transition rate to the state (v 1, w) is zero. 3. There are two cases on the removal of worm; infected hosts remove worms from themselves or worms are removed by receiving KSs. Then, the transition rate to the state (v 1, w+1) is the sum of the transition rates in these two cases: µ v,w = δv + β r vw 4. Non-vulnerable hosts send KSs to vulnerable hosts. The transition rate to the state (v, w + 1) is given by γ v,w = β r w(k v w). 5. Non-vulnerable hosts can be vulnerable again by detection of unknown vulnerable factors. The transition rate to the state (v, w 1) is given by θ v,w = δ r w Then the transition diagram of CTMC is depicted in Figure 1. Consider the probability: p v,w = P r{v (t) = v, W (t) = w}. Using the above listed equations, we obtain the following differential equations: 1 dt p v,w(t) = λ v 1,w p v 1,w (t) + µ v+1,w 1 p v+1,w 1 (t) + γ v,w 1 p v,w 1 (t) + θ v,w+1 p v,w+1 (t) v v,w p v,w (t) for v = 0,..., K, w = 0,...K v where v = λ v,w + µ v,w + γ v,w + θ v,w. Note that K v + w, because the total number of hosts is finite.

10 Figure 1: Transition diagram on the propagation model with KS 4 Models Surveyed 4.1 Winfried Gleissner Model Representation: Adjacency Matrix is used to represent program interactions. Viral state is represented as a row vector. v = (v 1, v 2,..., v N ). Formula Derived: % of computer infected Vs no. of function calls. probability of reaching a viral state v from state v after executing k calls Symbol Definitions: N : No.of User accounts in a system. m i : No.of programs for user account i. v i virus programs in user account i. Assumptions: All programs and interactions between them are identical. A program once infected remain infected.

11 Remarks: Models spread of virus in a single system. Process is the fundamental unit. Infection of the whole system (all programs) is the absorbing state. This definition of absorbing state is the key difference with respect to other models. The absorbing state is represented as v F = (m 1, m 2,.., m N ). 4.2 Okamura Et.al Model Representation: MAP Process. Deals with stochastic SIS and SIR models. Uses 2D Markov Chain. Formula Derived: D 0 Infinitesimal Generator Matrix (withdrawls). transitions. Represents phase D 1 Rate Matrix. Represents new arrivals. R reproduction number. Symbol Definitions: β Infection rate. γ Recovery Rate. v birth/death process. (i, j) represents a Markov State. Read as (Infected, Recovered). Remarks: Takes into account population changes due to birth/death of nodes. Birth is because of new nodes joining the network and death is due to either disruptions in the network or death of infected node.

12 4.3 Okamura Et.al Model Representation: MAP Process. Deals with stochastic SIS and SIR models. Uses 2D Markov Chain. Formula Derived: probabilities of hazard (PH). Mean time to Hazard (MTTH). Variance of Time to hazard (VTTH). coefficient of variance to hazard time(cvh). Expected maximum number of infected hosts(mx). Mean Time to Extinction(MTTE). Variance of time to extinction(vtte). coefficient of variance of extinction time(cve). Symbol Definitions: β Infection rate. γ Recovery Rate. v birth/death process. (i, j) represents a Markov State. Read as (Infected, Recovered). Assumptions: The authors evaluate virus propagation by defining two probabilistic events called hazard and extinction. That is the Markov process has two absorbing states. Hazard: All the computer hosts in the network are infected. Extinction: No computer host in the network is infected. Remarks: Introduces a Kill Signal (KS) that represents a means to notify each no de the existence of infection. KS is also used to model immunity level in living organisms and to model the impact of any remedial action taken by system administrators.

13 4.4 Wang Model Representation: Stochastic SIS and SIR models are used. The user vigilance is modelled as Susceptible Infected Immune Susceptible model(siis). Formula Derived: dη t dt = β < k > η t ε e δε (1 η) δη t dη t dt = β < k > η t (1 η δφ t t v η sds) δη t Symbol Definitions: Infection delay is represented as ε. Vigilance is modelled as: φ represents vigilance coefficient and quantity between 0 and 1. 0 indicates full susceptibility and 1 indicates complete immunity. v represents vigilance period, indicates the time during the node is vigilant against reinfection attempts. At the end of the period the node becomes fully susceptible to infections again. Assumptions: Vigilance delays and infection delays are modelled as exponential distributions. Remarks: Takes into account the latent state of virus infections in a computer. That is there is a delay between the virus first enters a computer and the time it starts to infect other computers. This delay is modelled though two different components infection delay and user vigilance. Infection delay could be because most viruses require appropriate user activity like opening of an attachment or launching an app. This delay also helps to deal with situations where a node once infected becomes cured before it becomes infectious. Vigilance delay is because the user of a system once attacked tends to be more vigilant. 4.5 Aditya Prakash Et.al Model Representation: A 2 N state markov chain is used to represent all the possible viral states. Viral state itself is defined by random variables x N, x N 1,..., x 2, x 1. Each of these random variables can take two values 0 or 1. 0 represents no infection

14 and 1 represents infected state. The viral state is represented by random variable Y and is represented as x N x N 1...x 2 x 1. Symbol Definitions: N represents the number of nodes in the network. Q represents the infinitesimal generator. The computer network G = (N, L) is represented as symmetric adjacency matrix A. Remarks: Takes into account the dynamic nature of network topology. 4.6 Kooij Et.al Model Representation: The problem is formulated as Non-Linear Dynamic. system (NLDS). SIS model is used. Formula Derived: Epidemic threshold λ s. This threshold is derived using Jacobian matrix and eigen vectors of the adjacent matrix and the viral state of the network. This threshold is then used to designing an optimum way to control the epidemic by using appropriate immunization policies. Basically a quality metric to measure is impact of immunization is determined. Symbol Definitions: The viral state is represented as a row vector: p t = (p 1,t, p 2,t,..., p n,t ) T : represents the total numb er of alternating behaviours. A T : represents adjacency matrix corresponding to alternating behaviour state T. p 2t+1 : probability of infection vector for odd days. p 2t : probability of infection vector for even days. Remarks: The major contributions are: formulating the problem by approximating it by a Non-linear Dynamical system (NLDS), derive the first closed formula for the epidemic threshold of timevarying graphs under the SIS model,

15 we show the usefulness of our threshold by presenting efficient heuristics and evaluate the effectiveness of our methods on synthetic and real data like the MIT reality mining graphs. 5 Modified Model In all the above cases value of β was constant. But according to figure 2 value of β should depend upon the characteristics of infected node and suspected node. As the viruses/worms are not that smart so they keep attacking the infected nodes again and again that s why value of β is the exponential decaying function. In case of deterministic network systems, Figure 2: Relationship between Value of β and Nodes changing the dependency of β value on other factors better results can be obtained which have been shown in figure 3. In the next pages, graphs have Figure 3: Simulink Model of Proposed Work been drawn for the following equation: dv dt = β newve λv δv

16 WORM BRAID.A (Braid) β= δ= Dash line is the curve obtained by the experimental data. Solid line represents the graph of the stochastic kill signal model. β=0.48 λ= δ= Curve obtained by Simulink model X-axis -No. of days Y-axis- No. of Infected Nodes

17 WORM DATOM.A (Datom) β= δ= Dash line is the curve obtained by the experimental data. Solid line represents the graph of the stochastic kill signal model. β=0.13 λ= δ= Curve obtained by Simulink model X-axis -No. of days Y-axis- No. of Infected Nodes

18 6 Conclusion We can use the mathematical models to measure the return on investment made by banks on security features by measuring the effectiveness of these measures in reducing financial losses in the event of a wide spread cyber attack. Using these models companies can measure the expected value of how much a company/government should spend on the security systems. The major shortcomings in existing models are they do not take into account the effect of security measures built into the system to stop the growth. As in the case of virus propagation models security protection measures cab be either deterministic or randomized. Deterministic protection measure are largely algorithm based like canary based buffer overflow protection. In such cases we agree that the time taken to overcome the protection mechanism is constant. Therefore no changes need to be made to the models proposed so far. But in case of protection mechanisms like memory layout randomization, the success of an attack is probabilistic and is subject to correctly guess the randomizing key. In such cases the reproduction factor R will be dependent on parameters such as size of randomization key. Finally, the purpose of an attack on a financial system is not to reduce productivity by taking away valuable computational resources, but to make the V2V system do a meaningful task from the attacker point of view. Hence an attack can remain latent inside the system and not b e activated until the attacker chooses to launch the attack. So there is a need to evaluate the spread of an attack in a financial network by applying SEIS and SEIR models rather than simple SIS and SIR models. In this modern era mobile banking is also becoming prominent. So we may work in the direction to build a mathematical model for virus propagation on time varying networks. 7 References W. Gleissner, A mathematical theory for the spread of computer viruses, Comput. Secur., vol. 8, no. 1, pp , H. Okamura, H. Kobayashi and T. Dohi, Markovian Modelling and Analysis of Internet Worm Propagation, Proc. 16th IEEE Intl. Symp. Eng. Software Reliability, H. Okamura and T. Dohi, Estimating Computer Virus Propagation Based on Markovian Arrival Processes, Proc. 16th IEEE Pacific Rim

19 Intl. Symp. on Dependable Computing, pp , Y. Wang and C. Wang, Modelling the effects of timing parameters on virus propagation, Proc. of the 2003 ACM workshop on Rapid malcode, ACM, New York, NY, USA, pp , B. A. Prakash, T. Hanghang, N. Valler, M. Faloutsos, and C. Faloutsos, Virus propagation on time-varying networks: theory and immunization algorithms, Proc. European Conf. on Machine learning and know ledge discovery in databases: Part III Springer-Verlag, Berlin, Heidelb erg, pp , P. V. Mieghem, J. Omic, and R. Kooij, Virus Spread in Networks, IEEE/ACM Transactions on Networking, vol. 17, no. 1, pp. 1-14, Feb