Malware in Online Social Networks: Modeling of Propagation Dynamics and Countermeasures

在线社交网络(OSN)的普及和多样化使用激励黑客和网络犯罪分子使用恶意软件(Malware)进行攻击。考虑到主要OSN的大量人口(例如，Facebook上的10多亿用户)，成功的攻击可能导致数千万用户配置文件被泄露，计算机/设备被感染。因此，本研究的目标是对恶意软件在OSN中的传播动态进行建模，并在获得的模型和参数分析的基础上，提出一个全面、有效的对抗系统，以在恶意软件传播的早期阶段检测、遏制和删除恶意软件。我们的研究项目包括三个密切相关的目标：(1)调查和数据收集；(2)分析建模和参数分析；(3)对策设计和评估。首先，我们进行众包调查，以研究用户的浏览行为，如访问频率、访问时间、访问时长、查看新帖子和私人消息的习惯，以及用户安全意识和实践。我们还收集有关当前防病毒(AV)产品的数据、它们对未知样本的有效性，以及反病毒供应商发布更新以响应过去攻击的速度。我们开发了新的分析模型，以解决现有模型的缺陷，这些模型假设通用恶意软件。具体地说，我们提出的模型真实地捕捉了每种类型的真实世界恶意软件的内部工作机制(例如，跨站点脚本蠕虫与特洛伊木马)及其传播机制。我们在模型中加入了现有模型中没有考虑的因素，即用户的浏览习惯、用户的安全意识和做法、时区以及反病毒产品的补丁速度，所有这些因素都对恶意软件的传播速度有显著影响。我们使用真实的社会网络图和之前收集的数据对模型进行验证和参数分析，利用模型的数值结果和参数分析，设计、实现和评估了一个新的针对OSN恶意软件的综合对抗系统。该系统包括主动措施(节省资源的恶意软件检测)和反应性措施(攻击警告、补丁分发、遏制和删除恶意软件)。我们通过正式的分析模型和离散事件模拟来评估所提出的对策的性能。本研究项目的结果将有助于使OSN成为互联网用户社交、交互、网络、阅读新闻、娱乐和进行金融交易的更安全的场所。通过防御OSN，该研究计划有助于保护互联网基础设施、企业和政府网络以及个人计算机和设备免受勒索软件、拒绝服务攻击、身份盗窃和数据盗窃等攻击。

The popularity and diverse uses of online social networks (OSNs) give incentives to hackers and cybercriminals to carry out attacks using malicious software (malware). Given large populations of major OSNs (e.g., more than one billion users on Facebook), a successful attack can result in tens of millions of user profiles being compromised and computers/devices being infected. Thus the objectives of this research program are to model the propagation dynamics of malware in OSNs and, based on the obtained models and parameter analyses, to propose a comprehensive, effective countermeasure system to detect, contain and remove malware in their early stages of propagation. Our research program consists of three closely related objectives: (1) surveys and data collection; (2) analytical modeling and parameter analyses; and (3) design and evaluation of countermeasures.First, we conduct crowdsourced surveys to study user browsing behavior such as frequency of visits, visiting hours, visit duration, habits of viewing new posts and private messages, and user security awareness and practices. We also collect data on current anti-virus (AV) products, their effectiveness against unknown samples, and the pace at which AV vendors released updates in response to past attacks. We develop novel analytical models that address shortcomings of existing models, which assume generic malware. Specifically, our proposed models faithfully capture the inner working mechanics of each type of real-world malware (e.g., cross-site scripting worms vs. Trojans) and their spreading mechanisms. We incorporate into the models factors not considered in existing models, namely, user browsing habits, user security awareness and practices, time zone, and the patching rate of AV products, all of which significantly impact the propagation speed of malware. We validate the models and perform parameter analyses using real social network graphs and the data collected earlier.Using numerical results from the models and the parameter analyses, we design, implement and evaluate a novel comprehensive countermeasure system against OSN malware. The system consists of both proactive measures (resource-efficient detection of malware) and reactive measures (warnings of attacks, distribution of patches, containment and removal of malware). We evaluate the performance of the proposed countermeasures via formal analytical modeling and discrete-event simulations.The outcomes of this research program will help make OSNs a safer place for Internet users to socialize, interact, network, read news, enjoy entertainments, and conduct financial transactions. By defending OSNs, this research program contributes towards protecting Internet infrastructures, enterprise and government networks, and individuals' computers and devices from attacks such as ransomware, denial-of-service attacks, identity thefts and data thefts.