Malware Propagation Modelling in Peer-to-Peer Networks: A Review <s> III. THE SIR MODEL <s> This paper discusses modeling and simulation issues associated with the stochastic behavior of a special type of a computer worm called a random constant scanning (RCS) worm. Although these worms propagate by randomly scanning network addresses to find hosts that are susceptible to infection, traditional RCS worm models are fundamentally deterministic. A density-dependent Markov jump process model for RCS worms is presented and analyzed. Conditions are shown for when worm models can safely ignore some stochastic properties of RCS worm propagation. A computationally simple hybrid deterministic/stochastic model for the observed scanning behavior on a local network due to the global propagation of an RCS scanning worm is also presented and discussed. <s> BIB001 </s> Malware Propagation Modelling in Peer-to-Peer Networks: A Review <s> III. THE SIR MODEL <s> Self-propagating codes, called worms, such as Code Red, Nimda, and Slammer, have drawn significant attention due to their enormously adverse impact on the Internet. Thus, there is great interest in the research community in modeling the spread of worms and in providing adequate defense mechanisms against them. In this paper, we present a (stochastic) branching process model for characterizing the propagation of Internet worms. The model is developed for uniform scanning worms and then extended to preference scanning worms. This model leads to the development of an automatic worm containment strategy that prevents the spread of a worm beyond its early stage. Specifically, for uniform scanning worms, we are able to 1) provide a precise condition that determines whether the worm spread will eventually stop and 2) obtain the distribution of the total number of hosts that the worm infects. We then extend our results to contain preference scanning worms. Our strategy is based on limiting the number of scans to dark-address space. The limiting value is determined by our analysis. Our automatic worm containment schemes effectively contain both uniform scanning worms and local preference scanning worms, and it is validated through simulations and real trace data to be nonintrusive. We also show that our worm strategy, when used with traditional firewalls, can be deployed incrementally to provide worm containment for the local network and benefit the Internet. <s> BIB002 </s> Malware Propagation Modelling in Peer-to-Peer Networks: A Review <s> III. THE SIR MODEL <s> P2P networking has become a promising technology and has achieved popularity as a mechanism for users to share files without the need for centralized servers. The rapid growth of P2P networks beginning with Kaza, Lime wire, Napsters, E-donkey, Gnutella etc makes them an attractive target to the creators of viruses and other security threats. This paper describes the major security issues on P2P networks (Viruses and worms) and presents the study of propagation mechanisms. In particular, the paper explores different P2P viruses and worms, their propagation methodology, outlines the challenges, and evaluates how P2P worms affect the network. The experimental results obtained will provide new direction in surmounting the security concerns in P2P Networks Index Terms — P2P, Viruses, Worms, Simulators, Propagation. <s> BIB003 </s> Malware Propagation Modelling in Peer-to-Peer Networks: A Review <s> III. THE SIR MODEL <s> There are the two common means for propagating worms: scanning vulnerable computers in the network and spreading through topological neighbors. Modeling the propagation of worms can help us understand how worms spread and devise effective defense strategies. However, most previous researches either focus on their proposed work or pay attention to exploring detection and defense system. Few of them gives a comprehensive analysis in modeling the propagation of worms which is helpful for developing defense mechanism against worms' spreading. This paper presents a survey and comparison of worms' propagation models according to two different spreading methods of worms. We first identify worms characteristics through their spreading behavior, and then classify various target discover techniques employed by them. Furthermore, we investigate different topologies for modeling the spreading of worms, analyze various worms' propagation models and emphasize the performance of each model. Based on the analysis of worms' spreading and the existing research, an open filed and future direction with modeling the propagation of worms is provided. <s> BIB004 </s> Malware Propagation Modelling in Peer-to-Peer Networks: A Review <s> III. THE SIR MODEL <s> Studies on the propagation of malware in mobile networks have revealed that the spread of malware can be highly inhomogeneous. Platform diversity, contact list utilization by the malware, clustering in the network structure, etc., can also lead to differing spreading rates. In this paper, a general formal framework is proposed for leveraging such heterogeneity to derive optimal patching policies that attain the minimum aggregate cost due to the spread of malware and the surcharge of patching. Using Pontryagin's Maximum Principle for a stratified epidemic model, it is analytically proven that in the mean-field deterministic regime, optimal patch disseminations are simple single-threshold policies. These policies are amenable to implementation and can serve as benchmarks for policies that have less knowledge of the network. Through numerical simulations, the behavior of optimal patching policies is investigated in sample topologies, and their advantages are demonstrated. <s> BIB005
Epidemiology is the study and analysis of disease spread in a population. Kermack-McKendrick  and his seminal gets the credit for the creation of the mathematical epidemiology. The Epidemiological model researchers' use in the study of the computer malware is the SusceptibleInfected (denoted by SI) and Susceptible-Infected-Removed model (denoted by SIR) BIB003 . The former model assumes that all peers in a P2P network are stay as either susceptible or infected  while the latter assumes that a host can recover or be disconnected from the network. The difference between the SI and SIR models depends on whether infected peers can become susceptible again after recovery or be disconnected from the network. If peers can recover or be disconnected from the network, then the SIR model can be used. In a typical P2P network, infected peers can be susceptible again if the host delete the malware by the use of an effective antivirus or disconnect from the P2P network entirely. However, this model does assume that once a host is removed, it will stay in 'removed' state forever. The removed hosts cannot be infected anymore and they do not try to infect others. This model helps by classifying peers as either susceptible, infected or removed/recovered. Susceptible -Class of peers that are clean but can be infected with malware, usually denoted by S. Infected -Class of infected peers, now also known as malware. The size of peers are usually denoted by I. Removed -Class of infected peers that are disconnected from the network are called removed/recovered peers, usually denoted by R. The number of peers in each of these classes changes with time, that is, S(t), I(t), and R(t) are functions of time t. The size of P2P network N is the sum of the sizes of the three classes in the SIR model  : A. DETERMINISTIC PROPAGATION Recent studies has proved that the epidemic models are effective and applicable for the propagation models in vulnerable P2P systems  . Deterministic propagation modelling is usually classified into continuous time and discrete time models  BIB001 . Continuous time models are expressed by a set of differential equation while the discrete time models are expressed by a set of different equations [10] . A malware can be a target and directly infect a random susceptible node in the continuous time model. Except the internally generated target lists, all other target discovery techniques employed by active worms satisfy this condition [10]  . Deterministic propagation models are usually simpler in analysis for large networks [10] . Some notable examples of deterministic malware propagation models are: In the classical simple epidemic model BIB002 BIB005 [13]  , a peer can only be in one of the only two states at any time: susceptible or infected, also known as the SI model. The model assumes that once a peer is infected by a malware, it will stay infected forever. Thus formal transition of any host can only be: susceptible to infected. The classical general Kermack-McKendrick epidemic model  [4] improves the classical simple epidemic model by considering removal of infected peers due to patching (installing software designed to fix security vulnerabilities). Zou et al. BIB004 presented a propagation model for the Code-Red worm, which is basically similar to the classical simple epidemic model. The two-factor worm model  extends the classical general epidemic model by considering the removal of infected peers and the susceptible peers getting infected. The discrete-time Analytical Active Worm Propagation  (AAWP), models the malware spread that employs random scanning and uniform scanning approach. It also measures the time an infected peer takes to infect other peers. Pros: Suitable for the studies of computer malware at the early stage for large network. Can be classified as continuous and discrete time in nature. More accurate in estimating propagation behaviour than the stochastic model. The Density-Dependent Markov jump process model for malware propagation uses the uniform scanning approach derived from the famous epidemic modelling  . The Gatson-Watson Markov model proposed by Sellke et al.  is a stochastic branching process model for characterizing malware propagation by employing the uniform scanning approach, which particularly focuses on the number of compromised peers against the number of malware scans, then offered a closed form expression for the relationship.