Optimal Distributed Malware Defense in Mobile Networks

Abstract

As malware attacks become more frequently in mobile networks, deploying an efficient defense system to protect against infection and to help the infected nodes to recover is important to prevent serious spreading and outbreaks. The technical challenges are that mobile devices are heterogeneous in terms of operating systems. The malware infects the targeted system in any opportunistic fashion via local and global connectivity, while the to-be-deployed defense system on the other hand would be usually resource limited. In this paper, we investigate the problem of how to optimally distribute the content-based signatures of malware, which helps to detect the corresponding malware and disable further propagation, to minimize the number of infected nodes. We model the defense system with realistic assumptions addressing all the above challenges that have not been addressed in previous analytical work. Based on the framework of optimizing the system welfare utility, which is the weighted summation of individual utility depending on the final number of infected nodes through the signature allocation, we propose an encounter-based distributed algorithm based on Metropolis sampler. Through theoretical analysis and simulations with both synthetic and realistic mobility traces, we show that the distributed algorithm achieves the optimal solution, and performs efficiently in realistic environments.

Existing System

Mobile malware can propagate through two different dominant approaches. Via MMS, a malware may send a copy of itself to all devices whose numbers are found in the address book of the infected handset. This kind of malware propagates in the social graph formed by the address books, and can spread very quickly without geographical limitations. The other approach is to use the short-range wireless media such as Bluetooth to infect the devices in proximity as “proximity malware.” Recent work of Wang et al. has investigated the proximity malware propagation features, and finds that it spreads slowly because of the human mobility, which offers ample opportunities to deploy the defense system. However, the approach for efficiently deploying such a system is still an ongoing research problem.

Proposed System

To Design a defense system for both MMS and proximity malware. Our research problem is to deploy an efficient defense system to help infected nodes to recover and prevent healthy nodes from further infection. We formulate the optimal signature distribution problem with the consideration of the heterogeneity of mobile devices and malware, and the limited resources of the defense system. Moreover, our formulated model is suitable for both the MMS and proximity malware propagation. We give a centralized greedy algorithm for the signature distribution problem. We prove that the proposed greedy algorithm obtains the optimal solution for the system, which provides the benchmark solution for our distributed algorithm design. We propose an encounter-based distributed algorithm to disseminate the malware signatures using Metropolis sampler. It only relies on local information and opportunistic contacts

Architecture