[Paper Review] Distributed interaction between computer virus and patch: A modeling study

Lu‐Xing Yang, Xiaofan Yang+2 more|arXiv (Cornell University)|May 13, 2017

Advanced Malware Detection Techniques26 references3 citations

TL;DR

This paper proposes the generic SIPS model, a nonlinear virus-patch interaction model that generalizes the linear SIPS model to better capture real-world dynamics in decentralized patch distribution. It establishes conditions under which the linear SIPS model accurately predicts virus and patch extinction or survival, enabling efficient performance assessment of decentralized patching under specific network and parameter constraints.

ABSTRACT

The decentralized patch distribution mechanism holds significant promise as an alternative to its centralized counterpart. For the purpose of accurately evaluating the performance of the decentralized patch distribution mechanism and based on the exact SIPS model that accurately captures the average dynamics of the interaction between viruses and patches, a new virus-patch interacting model, which is known as the generic SIPS model, is proposed. This model subsumes the linear SIPS model. The dynamics of the generic SIPS model is studied comprehensively. In particular, a set of criteria for the final extinction or/and long-term survival of viruses or/and patches are presented. Some conditions for the linear SIPS model to accurately capture the average dynamics of the virus-patch interaction are empirically found. As a consequence, the linear SIPS model can be adopted as a standard model for assessing the performance of the distributed patch distribution mechanism, provided the proper conditions are satisfied.

Motivation & Objective

• To address the limitations of existing node-level epidemic models that assume linear infecting/patching rates, which overestimate real-world dynamics.
• To develop a more accurate model for evaluating decentralized patch distribution mechanisms by incorporating nonlinear infection and patching rates.
• To identify conditions under which the simpler linear SIPS model can reliably approximate the average dynamics of virus-patch interactions.
• To provide a theoretical foundation for assessing the performance of decentralized patching in complex network topologies such as scale-free and small-world networks.
• To guide the selection of appropriate nonlinear infecting/patching rates in cases where the linear model fails, ensuring accurate prediction of system behavior.

Proposed method

• Proposes the generic SIPS model as a nonlinear extension of the linear SIPS model, incorporating nonlinear infecting and patching rates to better reflect real-world dynamics.
• Uses the exact SIPS model—derived from continuous-time Markov chains—as a benchmark to evaluate the accuracy of the generic and linear SIPS models.
• Applies stability analysis and spectral theory to matrices Q₁, Q₂, Q₄, and Dγ to derive conditions based on the spectral radius s(·) for extinction or survival of viruses and patches.
• Empirically evaluates model accuracy across 1025 parameter combinations on small-world networks, comparing dynamics of linear, generic, and exact SIPS models.
• Introduces the use of the vector P* (equilibrium state) and diagonal matrices diag(g(P*)) and diag(h(P*)) to model nonlinear rate dependencies on infection and patching probabilities.
• Employs numerical simulations on synthetic networks (e.g., 100-node small-world networks) to validate theoretical findings and assess model fidelity under varying conditions.

Experimental results

Research questions

• RQ1 Under what conditions does the linear SIPS model accurately capture the average extinction dynamics of viruses in a decentralized patch distribution system?
• RQ2 When is the linear SIPS model capable of reliably predicting the average extinction or survival of patches?
• RQ3 What are the conditions under which the linear SIPS model fails to represent the true average dynamics of virus-patch interactions?
• RQ4 How can a generic SIPS model with nonlinear rates be constructed to ensure accurate prediction when the linear model is insufficient?
• RQ5 How do network structure and parameter configurations affect the accuracy of linear versus nonlinear SIPS models in modeling decentralized patching?

Key findings

• The linear SIPS model accurately captures the average extinction process of viruses when s(Q₁) ≤ 0, indicating that the virus's effective infection rate is below the epidemic threshold.
• The linear SIPS model accurately predicts patch extinction when s(Q₁) ≤ 0 and s(Q₂) ≤ 0, or when s(Q₁) > 0 and s(Q₄) ≤ 0, suggesting that patch dynamics remain stable under certain spectral conditions.
• The linear SIPS model fails to capture the true average evolution of viruses when s(Q₁) > 0 and s(Q₄) ≤ 0, or when g = h, s(Q₂) > 0, and s(Q₁ − (Q₁ + Dγ)diag(P*) − diag(g(P*))) > 0, indicating nonlinear dynamics dominate.
• The linear SIPS model fails to predict patch dynamics accurately when s(Q₁) ≤ 0 and s(Q₂) > 0, or under the same nonlinear conditions involving g = h and positive spectral radii, signaling instability in patch propagation.
• In 697 out of 1025 tested parameter combinations on small-world networks, the linear SIPS model did not satisfy the accuracy conditions, necessitating the use of the generic SIPS model with nonlinear rates.
• Empirical results show consistent deviation patterns between the generic SIPS and exact SIPS models across different parameter collections, validating the theoretical criteria for model accuracy.