An Information-Theoretical View of Network-Aware Malware Attacks

This work investigates three aspects: (a) a network vulnerability as the non-uniform vulnerable-host distribution, (b) threats, i.e., intelligent malwares that exploit such a vulnerability, and (c) defense, i.e., challenges for fighting the threats. We first study five large data sets and observe consistent clustered vulnerable-host distributions. We then present a new metric, referred to as the non-uniformity factor, which quantifies the unevenness of a vulnerable-host distribution. This metric is essentially the Renyi information entropy and better characterizes the non-uniformity of a distribution than the Shannon entropy. Next, we analyze the propagation speed of networkaware malwares in view of information theory. In particular, we draw a relationship between Renyi entropies and randomized epidemic malware-scanning algorithms. We find that the infection rates of malware-scanning methods are characterized by the Renyi entropies that relate to the information bits in a nonunform vul...

• Type: Journal
• Year: 2008
• Where: CORR
• Authors: Zesheng Chen, Chuanyi Ji
• Keywords: CORR 2008, Education, Network-aware Malwares, Non-uniform Vulnerable-host Distribution, Vulnerable-host Distribution