An agent-based model to simulate coordinated response to malware outbreak within an organisation

International Journal of Information and Computer Security

Volumn 5, Issue 2, 2012, Pages 115-131

  Pan, Jonathan ^a   Fung, Chun Che ^a  

^a MURDOCH UNIVERSITY   (Australia)

Author keywords

Agent based modelling; Epidemiological modelling; Malware containment; Malware incident response plan

Indexed keywords

AUTONOMOUS AGENTS; COMPUTATIONAL METHODS; SIMULATION PLATFORM;

AGENT-BASED MODEL; AGENT-BASED MODELLING; ANTI-MALWARE; BUSINESS CONTINUITY; INCIDENT RESPONSE PLANS; IT ASSETS; RESEARCH PAPERS; RESPONSE PLANS;

MALWARE;

EID: 84873325887     PISSN: 17441765     EISSN: 17441773     Source Type: Journal    
DOI: 10.1504/IJICS.2012.051777     Document Type: Article

References (41)

1. Arino, J., Brauer, F., Driessche, P., Watmough, J. and Wu, J. (2006) 'Simple models for containment of a pandemic', Journal of The Royal Society Interface, 22 June, Vol. 3, No. 8, pp.453-457.
2. Axtell, R., Axelrod, R., Epstein, J.M. and Cohon, M. D. (1996) 'Aligning simulation models: a case study and results', Computational and Mathematical Organization Theory, Vol. 1, pp.123-141.
3. Boase, J. and Wellman, B. (2001) 'A plague of viruses: biological, computer and marketing', Current Sociology, Vol. 49, No. 6, pp.39-55.
4. Bose, A. and Shin, K.G. (2006) 'On mobile viruses exploiting messaging and Bluetooth services', Securecomm and Workshops, August 28-September 1, pp.1-10.
5. Brumley, D., Liu, L., Poosankam, P. and Song, D. (2005) 'Taxonomy and effectiveness of worm defense strategies', Carnegie Mellon University, School of Computer Science, Tech. Rep. CMU-CS-05-156, June.
6. Campbell, K., Gordon, L.A., Loeb, M.P. and Zhou, L. (2003) 'The economic cost of publicly announced information security breaches: empirical evidence from the stock market', Journal of Computer Security, IOS Press, Vol. 11, No. 3, pp.431-448.
7. Chen, L.C., Kaminsky, B., Tummino, T., Carley, K.M., Casman, E., Fridsma, D. and Yahja, A. (2004) 'Aligning simulation models of smallpox outbreaks', Intelligence and Security Informatics, Lecture Notes in Computer Science, Vol. 3073/2004, pp.1-16.
8. Chen, T. and Jamil, N. (2006) 'Effectiveness of quarantine in worm epidemics', ICC 2006, Istanbul, Turkey, 11-15 June.
9. Chen, Z., Gao, L. and Kwiat, K. (2003) 'Modeling the spread of active worms', INFOCOM 2003, Twenty-Second Annual Joint Conference of the IEEE Computer and Communications, IEEE Societies, 9 July, Vol. 3, p.1890.
10. Department of Homeland Security (2009) 'A roadmap for cybersecurity research', Department of Homeland Security, USA, November [online] http://www.cyber.st.dhs.gov/docs/DHSCybersecurity-Roadmap.pdf [accessed 6 September 2012].
11. Faghani, M.R. and Saidi, H. (2009) 'Malware propagation in online social networks', Malicious and Unwanted Software (MALWARE), 2009 4th International Conference, 13-14 October.
12. Garetto, M., Gong, W. and Towsley, D. (2003) 'Modeling malware spreading dynamics', INFOCOM 2003, Twenty-Second Annual Joint Conference of the IEEE Computer and Communications, IEEE Societies, 9 July, Vol. 3, pp.1869-1879.
13. Goranin, N. and Cenys, A. (2008) 'Genetic algorithm based internet worm propagation strategy modeling', Information Technology and Control, Technologija, ISSN 1392-124X.
14. InfoSecurity.com (2009) 'IBM warns over four percent Conficker infection rate', InfoSecurity.com, 3 April [online] http://www.infosecurity-magazine.com/ view/1065/ibm-warns-over-fourpercent-conficker-infection-rate/[accessed 6 March 2011].
15. Ingols, K., Chu, M., Lippmann, R., Webster, S. and Boyer, S. (2009) 'Modeling modern network attacks and countermeasures using attack graphs', Computer Security Applications Conference, ACSAC '09, 7 December, p.117.
16. Kermack, W.O. and McKendrick, A.G. (1927) 'A contribution to the mathematical theory of epidemics', Proceedings of the Royal Society of London, Series A, Vol. 115, pp.700-721.
17. Khalil, K.M., Abdel-Aziz, M., Nazmy, T.T., Salem, A.B.M. (2010) 'An agent-based modeling for pandemic influenza in Egypt', The 7th International Conference on Informatics and Systems (INFOS), 28-30 March.
18. Killcrece, G. (2005) 'Incident management', Software Engineering Institute, Carnegie Mellon University and Department of Homeland Security National Cyber Security Division, 19 December [online] https://buildsecurityin. us-cert.gov/bsi/articles/best-practices/incident/223-BSI.html [accessed 9 March 2011].
19. Killcrece, G., Kossakowski, K., Ruefle, R. and Zjicek, M. (2011) 'State of the practice of computer security incident response teams (CSIRTs)', CERT, Software Engineering Institute, Carnegie Mellon University, October [online] http://www.sei.cmu.edu/library/abstracts/reports/03tr001.cfm [accessed 2 March 2011].
20. Kim, S.W., Park, J.H., Lee, E.D., Choi, M.E. and Seo, S.W. (2010) 'Threat analysis of incubation period in malware epidemics', IEEE 71st Vehicular Technology Conference (VTC'10), Taipei, Taiwan, May.
21. Kim, T., Hwang, W., Zhang, A., Sen, S. and Ramanathan, M. (2008) 'Multi-agent model analysis of the containment strategy for avian influenza (AI) in South Korea', Bioinformatics and Biomedicine, BIBM '08, 3-5 November, p.335.
22. Kossakowski, K. (2005) 'Dynamics of incident response', 17th Annual FIRST Conference on Computer Security Incident Handling, FIRST.Org, 26 June.
23. Li, L., Liu, P. and Kesidis, G. (2008) 'Threshold smart walk for the containment of local worm outbreak', Global Telecommunications Conference, 30 November, pp.1-5.
24. Logan, P.Y. and Logan, S.W. (2003) 'Bitten by a bug: a case study in malware infection', Journal of Information Systems Education, Vol. 14, No. 4, pp.301-306.
25. Macal, C.M. and North, M.J. (2009) 'Agent-based modeling and simulation', Proceedings of the 2009 Winter Simulation Conference, pp.86-98.
26. Nicol, D.M., Davis, C.M. and Overbye, T. (2009) 'A testbed for power system security evaluation', International Journal of Information and Computer Security, Vol. 3, No. 2/2009, pp.114-131.
27. Pan, J. and Fung, C.C. (2008) 'Artificial intelligence in malware - cop or culprit?', The Ninth Postgraduate Electrical Engineering & Computing Symposium PEECS 2008, The University of Western Australia, Perth, Australia.
28. Pan, J., Fung, C.C. and Koh, W.W. (2009) 'Devious Chatbots - interactive malware with a plot', FIRA 2009, CCIS 44, pp.110-118.
29. Porras, P., Saidi, H. and Yegneswaran, V. (2010) 'Malware pandemics', Storming Media, 1 September [online] http://www.stormingmedia.us/66/6611/ A661135.html[accessed 6 March 2011].
30. Sellke, S., Shroff, N.B. and Bagchi, S. (2008) 'Modeling and automated containment of worms', IEEE Transactions on Dependable and Secure Computing, April, Vol. 5, No. 2.
31. Skvortsov, A., Connell, R.B., Dawson, P. and Gailis, R. (2007) 'Epidemic modelling: validation of agent-based simulation by using simple mathematical models', Proceedings of Land Warfare Conference 2007, pp.221-227.
32. Staniford, S., Paxson, V. and Weaver, N. (2002) 'How to own the internet in your spare time', Proceedings of the 11th USENIX Security Symposium.
33. Verizon (2010) '2010 data breach investigations report', Verizon Business, 28 July [online] http://www.verizonbusiness.com/go/ 2010databreachreport/[accessed 2 March 2011].
34. Vlachos, V., Raptis, A. and Spinellis, D. (2006) 'PROMISing steps towards computer hygiene', International Network Conference (INC2006), Plymouth, UK, July, pp.229-236.
35. Vlachos, V., Vouzi, V., Chatziantoniou, D. and Spinellis, D. (2005) 'NGCE - network graphs for computer epidemiologists', Advances in Informatics: 10th Panhellenic Conference on Informatics, PCI 2005, Berlin, November, pp.672-683.
36. Wiik, J., Gonzalez, J.J. and Kossakowski, K. (2006) 'Effectiveness of proactive CSIRT services', 18th Annual First Conference, Baltimore, Maryland, USA, 30 June.
37. Wilensky, U. (1999) 'NetLogo', Center for Connected Learning and Computer-Based Modeling, Northwestern University, Evanston, IL [online] http://ccl.northwestern.edu/netlogo/[accessed 1 March 2011].
38. Zelonis, K. (2004) 'Avoiding the cyber pandemic: a public health approach to preventing malware propagation', Heinz School, Carnegie Mellon University, 8 December.
39. Zou, C.C., Gong, W., Towsley, D. and Gao, L. (2005) 'The monitoring and early detection of internet worms', IEEE/ACM Transactions on Networking, October, Vol. 13, No. 5.
40. Zou, C.C., Towsley, D. and Gong, W. (2006) 'On the performance of internet worm scanning strategies', Performance Evaluation, July, Vol. 63, No. 7.
41. Zou, C.C., Towsley, D. and Gong, W., (2004) 'Email worm modeling and defense', 13th International Conference on Computer Communications and Networks (ICCCN'04), Chicago, USA, 11-13 October, pp.409-414.