The popularity and widespread usage of online social networks (OSN) have attracted cyber criminals who have used OSNs as a platform to spread malware. Among different types of malware in OSNs, Trojan is the most popular type with hundreds of attacks on OSN users in the past few years. Trojans infecting a user's computer have the ability to steal confidential information, install ransomware and infect other computers in the network. Therefore, it is important to understand propagation dynamics of Trojans in OSNs in order to detect, contain and remove them as early as possible. In this article, we present an analytical model to study propagation characteristics of Trojans and factors that impact their propagation in an online social network. The proposed model assumes all the topological characteristics of real online social networks. Moreover, the model takes into account attacking trends of modern Trojans, the role of anti-virus (AV) products, and security practices of OSN users and AV software providers. By taking into account these factors, the proposed model can accurately and realistically estimate the infection rate caused by a Trojan malware in an OSN as well as the recovery rate of the user population.
Existing works on modelling malware propagation in online social networks include @cite_13 @cite_29 and @cite_55 . Faghani and his collaborators @cite_13 @cite_29 modeled the propagation of cross-site-scripting (XSS) worms in OSNs. @cite_55 modeled the propagation of Trojans in the social network Twitter, which is represented by directed graphs due to one-directional (follower-followee) relationships. To the best of our knowledge, the analytical model we propose in this article is the first that characterizes the propagation of Trojans in social networks represented by undirected graphs such as Facebook, LinkedIn and Orkut.
@cite_55 @cite_29 @cite_13
2055407442 1984156542
Social Networks have rapidly become one of the most used Internet based applications. The structure and ease of information dissemination provides an opportunity for adversaries to use it for their own malicious purpose. In this paper we investigate a popular social network – Twitter as a malware propagation medium. We present a basic model for Twitter-based malware propagation using epidemic theory. Our analysis shows that even with a low degree of connectivity and a low probability of clicking links, Twitter and its structure can be exploited to infect many nodes. We present analytical models and simulation results that characterize the impacts of the following factors on the propagation of cross-site scripting (XSS) worms in online social networks (OSNs): 1) user behaviors, namely, the probability of visiting a friend's profile versus a stranger's; 2) the highly clustered structure of communities; and 3) community sizes. Our analyses and simulation results show that the clustered structure of a community and users' tendency to visit their friends more often than strangers help slow down the propagation of XSS worms in OSNs. We then present a study of selective monitoring schemes that are more resource efficient than the exhaustive checking approach used by the Facebook detection system which monitors every possible read and write operation of every user in the network. The studied selective monitoring schemes take advantage of the characteristics of OSNs such as the highly clustered structure and short average distance to select only a subset of strategically placed users to monitor, thus minimizing resource usage while maximizing the monitoring coverage. We present simulation results to show the effectiveness of the studied selective monitoring schemes for XSS worm detection.