Visibility-Aware Optimal Contagion of Malware Epidemics

TL;DR

This paper analyzes optimal malware spreading strategies that balance maximizing infection spread with maintaining stealth, revealing that simple threshold policies effectively manage this trade-off.

Contribution

It introduces a framework for optimal malware contagion considering visibility levels, showing that single-threshold policies are optimal in the mean-field deterministic setting.

Findings

Single-threshold policies optimize the spread-stealth trade-off.

Only one malware variant is active at a time.

The strategy shifts from spreading to stealth at a specific threshold time.

Abstract

Recent innovations in the design of computer viruses have led to new trade-offs for the attacker. Multiple variants of a malware may spread at different rates and have different levels of visibility to the network. In this work we examine the optimal strategies for the attacker so as to trade off the extent of spread of the malware against the need for stealth. We show that in the mean-field deterministic regime, this spread-stealth trade-off is optimized by computationally simple single-threshold policies. Specifically, we show that only one variant of the malware is spread by the attacker at each time, as there exists a time up to which the attacker prioritizes maximizing the spread of the malware, and after which she prioritizes stealth.