Malware in Online Social Networks: Modeling of Propagation Dynamics and Countermeasures

点击翻译按钮获取中文摘要

The popularity and diverse uses of online social networks (OSNs) give incentives to hackers and cybercriminals to carry out attacks using malicious software (malware). Given large populations of major OSNs (e.g., more than one billion users on Facebook), a successful attack can result in tens of millions of user profiles being compromised and computers/devices being infected. Thus the objectives of this research program are to model the propagation dynamics of malware in OSNs and, based on the obtained models and parameter analyses, to propose a comprehensive, effective countermeasure system to detect, contain and remove malware in their early stages of propagation. Our research program consists of three closely related objectives: (1) surveys and data collection; (2) analytical modeling and parameter analyses; and (3) design and evaluation of countermeasures.******First, we conduct crowdsourced surveys to study user browsing behavior such as frequency of visits, visiting hours, visit duration, habits of viewing new posts and private messages, and user security awareness and practices. We also collect data on current anti-virus (AV) products, their effectiveness against unknown samples, and the pace at which AV vendors released updates in response to past attacks. ******We develop novel analytical models that address shortcomings of existing models, which assume generic malware. Specifically, our proposed models faithfully capture the inner working mechanics of each type of real-world malware (e.g., cross-site scripting worms vs. Trojans) and their spreading mechanisms. We incorporate into the models factors not considered in existing models, namely, user browsing habits, user security awareness and practices, time zone, and the patching rate of AV products, all of which significantly impact the propagation speed of malware. We validate the models and perform parameter analyses using real social network graphs and the data collected earlier.******Using numerical results from the models and the parameter analyses, we design, implement and evaluate a novel comprehensive countermeasure system against OSN malware. The system consists of both proactive measures (resource-efficient detection of malware) and reactive measures (warnings of attacks, distribution of patches, containment and removal of malware). We evaluate the performance of the proposed countermeasures via formal analytical modeling and discrete-event simulations.******The outcomes of this research program will help make OSNs a safer place for Internet users to socialize, interact, network, read news, enjoy entertainments, and conduct financial transactions. By defending OSNs, this research program contributes towards protecting Internet infrastructures, enterprise and government networks, and individuals' computers and devices from attacks such as ransomware, denial-of-service attacks, identity thefts and data thefts.