Malware Propagation Modelling in Peer-to-Peer Networks: A Review <s> C. LOGISTIC PROPAGATION <s> This paper discusses modeling and simulation issues associated with the stochastic behavior of a special type of a computer worm called a random constant scanning (RCS) worm. Although these worms propagate by randomly scanning network addresses to find hosts that are susceptible to infection, traditional RCS worm models are fundamentally deterministic. A density-dependent Markov jump process model for RCS worms is presented and analyzed. Conditions are shown for when worm models can safely ignore some stochastic properties of RCS worm propagation. A computationally simple hybrid deterministic/stochastic model for the observed scanning behavior on a local network due to the global propagation of an RCS scanning worm is also presented and discussed. <s> BIB001 </s> Malware Propagation Modelling in Peer-to-Peer Networks: A Review <s> C. LOGISTIC PROPAGATION <s> Self-propagating codes, called worms, such as Code Red, Nimda, and Slammer, have drawn significant attention due to their enormously adverse impact on the Internet. Thus, there is great interest in the research community in modeling the spread of worms and in providing adequate defense mechanisms against them. In this paper, we present a (stochastic) branching process model for characterizing the propagation of Internet worms. The model is developed for uniform scanning worms and then extended to preference scanning worms. This model leads to the development of an automatic worm containment strategy that prevents the spread of a worm beyond its early stage. Specifically, for uniform scanning worms, we are able to 1) provide a precise condition that determines whether the worm spread will eventually stop and 2) obtain the distribution of the total number of hosts that the worm infects. We then extend our results to contain preference scanning worms. Our strategy is based on limiting the number of scans to dark-address space. The limiting value is determined by our analysis. Our automatic worm containment schemes effectively contain both uniform scanning worms and local preference scanning worms, and it is validated through simulations and real trace data to be nonintrusive. We also show that our worm strategy, when used with traditional firewalls, can be deployed incrementally to provide worm containment for the local network and benefit the Internet. <s> BIB002 </s> Malware Propagation Modelling in Peer-to-Peer Networks: A Review <s> C. LOGISTIC PROPAGATION <s> With the beginning of the 21st century emerging peer-to-peer networks ushered in a new era of large scale media exchange. Faced with ever increasing volumes of traffic, legal threats by copyright holders, and QoS demands of customers, network service providers are urged to apply traffic classification and shaping techniques. These systems usually are highly integrated to satisfy the harsh restrictions present in network infrastructure. They require constant maintenance and updates. Additionally, they have legal issues and violate both the net neutrality and end-to-end principles. <s> BIB003 </s> Malware Propagation Modelling in Peer-to-Peer Networks: A Review <s> C. LOGISTIC PROPAGATION <s> Centralized botnets are easy targets for takedown efforts by computer security researchers and law enforcement. Thus, botnet controllers have sought new ways to harden the infrastructures of their botnets. In order to meet this objective, some botnet operators have (re)designed their botnets to use Peer-to-Peer (P2P) infrastructures. Many P2P botnets are far more resilient to takedown attempts than centralized botnets, because they have no single points of failure. However, P2P botnets are subject to unique classes of attacks, such as node enumeration and poisoning. In this paper, we introduce a formal graph model to capture the intrinsic properties and fundamental vulnerabilities of P2P botnets. We apply our model to current P2P botnets to assess their resilience against attacks. We provide assessments on the sizes of all eleven active P2P botnets, showing that some P2P botnet families contain over a million bots. In addition, we have prototyped several mitigation strategies to measure the resilience of existing P2P botnets. We believe that the results from our analysis can be used to assist security researchers in evaluating mitigation strategies against current and future P2P botnets. <s> BIB004 </s> Malware Propagation Modelling in Peer-to-Peer Networks: A Review <s> C. LOGISTIC PROPAGATION <s> P2P networking has become a promising technology and has achieved popularity as a mechanism for users to share files without the need for centralized servers. The rapid growth of P2P networks beginning with Kaza, Lime wire, Napsters, E-donkey, Gnutella etc makes them an attractive target to the creators of viruses and other security threats. This paper describes the major security issues on P2P networks (Viruses and worms) and presents the study of propagation mechanisms. In particular, the paper explores different P2P viruses and worms, their propagation methodology, outlines the challenges, and evaluates how P2P worms affect the network. The experimental results obtained will provide new direction in surmounting the security concerns in P2P Networks Index Terms — P2P, Viruses, Worms, Simulators, Propagation. <s> BIB005 </s> Malware Propagation Modelling in Peer-to-Peer Networks: A Review <s> C. LOGISTIC PROPAGATION <s> There are the two common means for propagating worms: scanning vulnerable computers in the network and spreading through topological neighbors. Modeling the propagation of worms can help us understand how worms spread and devise effective defense strategies. However, most previous researches either focus on their proposed work or pay attention to exploring detection and defense system. Few of them gives a comprehensive analysis in modeling the propagation of worms which is helpful for developing defense mechanism against worms' spreading. This paper presents a survey and comparison of worms' propagation models according to two different spreading methods of worms. We first identify worms characteristics through their spreading behavior, and then classify various target discover techniques employed by them. Furthermore, we investigate different topologies for modeling the spreading of worms, analyze various worms' propagation models and emphasize the performance of each model. Based on the analysis of worms' spreading and the existing research, an open filed and future direction with modeling the propagation of worms is provided. <s> BIB006 </s> Malware Propagation Modelling in Peer-to-Peer Networks: A Review <s> C. LOGISTIC PROPAGATION <s> Studies on the propagation of malware in mobile networks have revealed that the spread of malware can be highly inhomogeneous. Platform diversity, contact list utilization by the malware, clustering in the network structure, etc., can also lead to differing spreading rates. In this paper, a general formal framework is proposed for leveraging such heterogeneity to derive optimal patching policies that attain the minimum aggregate cost due to the spread of malware and the surcharge of patching. Using Pontryagin's Maximum Principle for a stratified epidemic model, it is analytically proven that in the mean-field deterministic regime, optimal patch disseminations are simple single-threshold policies. These policies are amenable to implementation and can serve as benchmarks for policies that have less knowledge of the network. Through numerical simulations, the behavior of optimal patching policies is investigated in sample topologies, and their advantages are demonstrated. <s> BIB007
Scenario: To get an idea of how a malware propagate, we will try to recreate the SIR model from a simple mathematical model that can capture the essential dynamics of some malwares as introduced by current work BIB003 [2]  BIB007 . Under the assumption of every peer downloads files from the P2P network, any host can contain a malware. Now imagine an infected node getting through into a clean P2P network. It doesn't matter how the one node got infected but keeping in mind that some malwares are designed to propagate and infect any node they come in contact with, the malware can now infect and disrupt the system. The clean nodes are susceptible of getting infected and thereby the network gets infected too as a whole with time. The type of malware plays a role on the rate at which the system gets infected. Malwares that propagates itself is in the form of malicious executable files shared by P2P peers have enticing names of original files or might be an infected file. The intent of the Logical model below is to predict the propagation complexity of a malware spread in a P2P network. The classical simple epidemic model for a finite population can be represented by the differential equation below. Traditionally mathematical epidemic model  [12] describes the SIR model using a differential equation to measure the infected peers; let be the fraction of a malware and 1 is the fraction of clean files which are susceptible, therefore Where is the rate at which a peer gets infected the network and is the rate at which the other peers in the network flag the malware and got exposed. For different types of P2P networks, and will vary. The Classical Simple Epidemic Model is the most simple and popular differential equation model  . Let's suppose is the number of files in a P2P network, and is the number of infected peers in the th system of the P2P network. Then one can assume Where is the number of peers that can be infected in the P2P network . By assuming that any peer can be infected with the malware at random, if each malware starts propagating embedding peers, and the P2P network contains peers that are either infected or recovered, then an approximation for the total number of peers which are infected by the malware in the network is The number of peers that are still susceptible of being infected in the network , , is the total (T) number of infected peers which will be = . And to get the approximated number of the peers that can be infected in the network Finally, computing this models together gives us the discrete logistic model for the propagation of malware in P2P networks: IV. DISCUSSIONS Peer-to-Peer malware modelling is vital for understanding the dynamic impact of malware attacks. The modelling provides a comprehensive approach to help researchers study the fundamental propagation patterns that characterize malware propagation. On this basis, P2P networks can predict their potential damages and develop effective countermeasures. Recently, authors are using the mathematical epidemiology models to study the spread of malware and its propagation in p2p networks BIB002 [5] BIB004 . Due to the complexity of the malware spread in the p2p network, researchers are still struggling to develop an airtight solution to its propagation. Rossow et al. BIB004 models the propagation of virus in p2p networks by developing mathematical equations that examines the expected behaviour of the p2p network. In BIB005 , different types of p2p malwares has been discussed. About seven different types of malwares were introduced along with their propagation methods and forms. The study was based on the file propagation model of susceptible-infected-recovered (SIR) model which was developed into the susceptible-infected-exposed-removed (SIER) model. The research analysis was based on assumptions and simulations. Such analysis require numerical calculations to be proved. The modelling consists of understanding the different types of propagation modelling and their characteristics. Deterministic and Stochastic propagation models have emerged to characterize P2P malware spread in continuous and discrete-time nature. The mathematical models [10]  has helped researchers to derive models that can eradicate topology-based malwares as well as limit and control the malware spread, previous work BIB002 [19]  [16] presented certain strategies to prevent topology-based malwares from spreading. For example, Sellke et al  relied on the branching process model to characterize the propagation of random scanning malwares rather than on mathematical analysis. Their paper demonstrates a fairly comprehensive analysis on the condition that determines whether the malwares die out completely or the total amount of hosts that the malware will infect can be determined. However, this model describes the containment process of uniform scan malwares instead of modelling the dynamic propagation modelling between each pair of nodes. Therefore, it poorly estimates the propagation of malwares. In addition, the study BIB003 [9] rely on simulations to model the propagation. They investigate deeply on simulating the best network environment to thwart the propagation of topology-based malwares. The result of this paper supports the logical propagation modelling to facilitate determining the maximum number of peers in a P2P network that can be infected in a given period. The novel logic reviewed in this paper models the propagation process of a P2P malware by a differential equation of logic. The logical propagation model can be applied to the topology-based malwares as well as a discrete-time deterministic model. Table I . gives a summary of the different types of the propagation modelling reviewed in this paper to compare the nature and nature accuracy of the models. The model type SI and SIR in the table represents Susceptible-Infected model and the Susceptible-Infected-Removed model. In this table, the deterministic models, stochastic propagation models and the logistic propagation models proposed to date are shown to differentiate between the models. The deterministic, stochastic and logistic propagation models functionality in this table were derived from prior research BIB003 [10] BIB006 [15] BIB001 . The use of Logistic malware propagation modelling is still developing in the computing paradigm. The approach's ease of use gives it an edge on other propagation models. It is a mathematical model that has not gotten enough attention of researchers to give rise to a better model that would help information security managers make decisions. BIB007 on modelling the propagation of worms can be said to be existent and more progressive than the recent Logical approach. Our reason for trusting the Logical approach is the ease of derivation of the propagation model in general and this review paper. We used the discrete logistic model that shows how infected files can spread in a P2P network by deriving an expression from the SIR model  . Since P2P malware are similar to the viruses in the study of epidemiology  , we used the epidemic model to predict the behavior of malware propagation. However, 'internet based' epidemic models have their limitations. They can only be used on P2P networks that allows peers to share unencrypted files. Encrypted file-share is an approach by the P2P network developers to make the system more secure by allowing peers to share encrypted messages using the DiffieHelman key exchange between peers as some sort of verification between them  . Therefore, our review offers a predictive propagation model study that offers the following suggestive solutions. Firstly, P2P networks security should be revisited and given more attention by the Governments and Research bodies. Secondly, encryption should be introduced to make propagation more difficult or impossible in P2P networks. Lastly, P2P networks should develop a more trusted mechanism for verification of legitimate nodes in a network system. This paper shows our initial review of malware propagation in P2P networks with debatable assumptions. Future work will be analyzing the logical matrix model to serve as a source model to develop more advanced models from. We plan to explore further the effects of malware propagation on the network performance and the possibility of securing the network from malware invasion and work towards developing a better model that will explain the propagation as well as its vulnerability. Such a model would help predict malware spread in a given protocol and help develop ways to increase P2P network security.