Malware in Online Social Networks: Modeling of Propagation Dynamics and Countermeasures

在线社交网络（OSN）的流行和多样化使用促使黑客和网络犯罪分子使用恶意软件（恶意软件）进行攻击。考虑到主要OSN的大量人口（例如，Facebook上有超过10亿用户），成功的攻击可能导致数千万用户配置文件受损，计算机/设备受到感染。因此，本研究计划的目标是在OSN的恶意软件的传播动态建模，并根据所获得的模型和参数分析，提出一个全面的，有效的对策系统，以检测，包含和删除恶意软件在其传播的早期阶段。我们的研究计划包括三个密切相关的目标：（1）调查和数据收集;（2）分析建模和参数分析;（3）对策的设计和评估。首先，我们进行众包调查，研究用户浏览行为，如访问频率、访问时间、访问时长、查看新帖子和私信的习惯，以及用户安全意识和实践。我们还收集有关当前防病毒（AV）产品的数据，它们对未知样本的有效性，以及AV供应商发布更新以应对过去攻击的速度。** 我们开发了新的分析模型，解决了现有模型的缺点，这些模型假设了一般的恶意软件。具体来说，我们提出的模型忠实地捕捉了每种类型的真实世界恶意软件的内部工作机制（例如，跨站点脚本蠕虫与特洛伊木马）及其传播机制。我们将现有模型中未考虑的因素纳入模型中，即用户浏览习惯，用户安全意识和实践，时区以及AV产品的修补率，所有这些都显着影响恶意软件的传播速度。我们使用真实的社交网络图和之前收集的数据来验证模型并进行参数分析。**利用模型和参数分析的数值结果，我们设计，实现和评估一种新的综合对策系统对OSN恶意软件。该系统包括主动措施（资源有效的恶意软件检测）和反应措施（攻击警告，补丁分发，遏制和删除恶意软件）。我们通过正式的分析建模和离散事件模拟评估所提出的对策的性能。**这项研究计划的成果将有助于使OSN成为互联网用户社交，互动，网络，阅读新闻，享受娱乐和进行金融交易的更安全的地方。通过保护OSN，该研究计划有助于保护互联网基础设施，企业和政府网络以及个人计算机和设备免受勒索软件，拒绝服务攻击，身份盗窃和数据盗窃等攻击。

The popularity and diverse uses of online social networks (OSNs) give incentives to hackers and cybercriminals to carry out attacks using malicious software (malware). Given large populations of major OSNs (e.g., more than one billion users on Facebook), a successful attack can result in tens of millions of user profiles being compromised and computers/devices being infected. Thus the objectives of this research program are to model the propagation dynamics of malware in OSNs and, based on the obtained models and parameter analyses, to propose a comprehensive, effective countermeasure system to detect, contain and remove malware in their early stages of propagation. Our research program consists of three closely related objectives: (1) surveys and data collection; (2) analytical modeling and parameter analyses; and (3) design and evaluation of countermeasures.******First, we conduct crowdsourced surveys to study user browsing behavior such as frequency of visits, visiting hours, visit duration, habits of viewing new posts and private messages, and user security awareness and practices. We also collect data on current anti-virus (AV) products, their effectiveness against unknown samples, and the pace at which AV vendors released updates in response to past attacks. ******We develop novel analytical models that address shortcomings of existing models, which assume generic malware. Specifically, our proposed models faithfully capture the inner working mechanics of each type of real-world malware (e.g., cross-site scripting worms vs. Trojans) and their spreading mechanisms. We incorporate into the models factors not considered in existing models, namely, user browsing habits, user security awareness and practices, time zone, and the patching rate of AV products, all of which significantly impact the propagation speed of malware. We validate the models and perform parameter analyses using real social network graphs and the data collected earlier.******Using numerical results from the models and the parameter analyses, we design, implement and evaluate a novel comprehensive countermeasure system against OSN malware. The system consists of both proactive measures (resource-efficient detection of malware) and reactive measures (warnings of attacks, distribution of patches, containment and removal of malware). We evaluate the performance of the proposed countermeasures via formal analytical modeling and discrete-event simulations.******The outcomes of this research program will help make OSNs a safer place for Internet users to socialize, interact, network, read news, enjoy entertainments, and conduct financial transactions. By defending OSNs, this research program contributes towards protecting Internet infrastructures, enterprise and government networks, and individuals' computers and devices from attacks such as ransomware, denial-of-service attacks, identity thefts and data thefts.