Optimization Cost in SIS Model of Worm Infection
Jonghyun Kim, Sridhar Radhakrishnan, and Jongsoo Jang
ABSTRACTRecently, there has been a constant barrage of worms over the Internet. Besides threatening network security, these worms create an enormous economic burden in terms of loss of productivity not only for the victim hosts, but also for other hosts, as these worms create unnecessary network traffic. Further, measures taken to filter these worms at the router level incur additional network delays because of the extra burden placed on the routers. To develop appropriate tools for thwarting the quick spread of worms, researchers are trying to understand the behavior of worm propagation with the aid of epidemiological models. In this study, we present an optimization model that takes into account infection and treatment costs. Using this model we can determine the level of treatment to be applied for a given rate of infection spread.
for the study of computer worms/viruses has been investigated in [4]-[6]. An analytical model is presented in [5] and [6] that captures the impact of the underlying topology on worm propagation. However, controlling the spread of worms in computer networks has recently become one of the most important issues. In this letter, we investigate the effect of controlling the spread of computer worms on network delays. A model is presented that can be used to determine the adequate level of control on the total network delay the delay caused by worms and the delay caused by controlling worm propagation. In addition, we present the optimal control problem of minimizing the total cost of infection which can be interpreted KeywordsOptimal control, treatment cost, epidemic model, as the network delay incurred by both infection and treatment. Pontryagins maximum principle. This letter focuses on the application of optimal control theory to minimizing the value of treatment costs. We derive the necessary conditions for our cost optimization problem which I. Introduction is solved numerically. Internet worms have recently become a major problem for the The rest of the letter is organized as follows. Section II security of Internet networks, causing a considerable amount of presents some of the important issues in computer networks. resources and time to be wasted on the prevention and treatment Section III gives a brief review of the classical epidemic of virulent attacks. In general, worms, defined as self- models and a modification of the susceptible-infectiouspropagating codes, have become much more sophisticated since susceptible (SIS) model with treatment to control Internet the Morris worm appeared in 1988 [1]. The task of detection and worm propagation. The analysis of optimization problems is prevention of worms has become more difficult with our existing given in section IV. Our numerical solution of the optimal computing infrastructure. The convenience of the Internet makes control problem is also introduced in this section. We conclude it more vulnerable to malicious Internet exploits. In the area of the letter with an outline of our future work in section V. virus and worm modeling, many studies have employed simple epidemiological models to understand the general characteristics of worm propagation. Epidemiological propagation models have II. Statement of Problems traditionally been used to understand and model the spread of 1. Infection Cost vs. Treatment Cost biological infectious diseases [2], [3]. The use of these models
Manuscript received Feb. 20, 2006; revised Aug. 17, 2006. Jonghyun Kim (phone: [phone], email: [e-mail]) and Jongsoo Jang (email: [e-mail]) are with Information Security Research Division, ETRI, Daejeon, Korea. Sridhar Radhakrishnan (email: [e-mail]) is with the Department of Computer Science, University of Oklahoma, Norman, USA.
This letter considers the optimal control problem of minimizing the value of two costs: first is the infection cost which could impose a constant per period network cost (say, in link bandwidth, network delay, and excessive consumption of
692
Jonghyun Kim et al.
ETRI Journal, Volume 28, Number 5, October 2006
resources) caused by infection; the second is the treatment cost also referred to as network delay incurred by a certain level of filtering countermeasures. In other words, both the infection cost and the treatment cost are considered to be variations of the nodal network delay. Our optimal control approach is proposed, which enables tradeoffs between the infection cost of compromised systems and the treatment cost of defensive countermeasures, with respect to time.
Table 1. Notations of SIS infection model.
Notation N S(t) I(t) Q(t) Definition Size of total vulnerable population Number of susceptible nodes at time t Number of infectious nodes at time t Number of treated infectious nodes at time t Infection rate Curing rate of an infectious node Treatment rate of an infectious node Infection cost A function of treatment cost Adjoint variable Epidemic threshold
CI C(Q(t))
2. Choosing the Number of Nodes to Filter
We present a notion of an optimal number of nodes to receive filtering treatment at a certain infection rate, providing both a mathematical model of the control factors affecting how many nodes to filter, and the numerical solution of our analytical model. For the worm propagation model, we apply the classical SIS model [2], [3]. With this model, the assumptions are a) that during each period the infected nodes can receive treatment that will increase their rate of recovery, and b) they have no preventive properties upon recovery. The treatment will also be assumed to exist in discrete time.
dI (t ) = I (t )[ N I (t )] I (t ). dt
(1)
We assume that at the beginning, t = 0, one host is infectious and the other (N 1) nodes are all susceptible. Let S(t) = N I(t) denote the number of susceptible nodes at time t. Replace I(t) in (1) by N S(t) and we get
III. SIS Infection Model
Two classical deterministic epidemic models are the basis of our experimental design. In classical epidemic models, a node is defined as an infectious node at time t if it has been infected by a worm before t. A node that is vulnerable to a worm is called a susceptible node.
dS (t ) = S (t )[ N S (t )] + [ N S (t )]. dt
The solution to (1) is
I (t ) = I 0 ( N ) . I 0 + ( N I 0 )e ( N )t
(2)
(3)
1. Infection without Treatment
The most common mechanism of infection is through contact with an infected node, and the mechanism of recovery is either deterministic or purely stochastic with a certain typical time of recovery. In the classical SIS model [2], [3], a recovered node immediately becomes susceptible again, while in a more complicated susceptible-infectious-removed (SIR) model [7], cured nodes become immune and effectively excluded from further dynamics. In the SIS model, each node stays in one of two states: susceptible or infectious. Each susceptible node becomes an infectious one at a certain rate. At the same time, infectious nodes are cured and become again susceptible at a different rate. In this model, having the infection and being cured, does not confer immunity. Infectious nodes have a constant probability of recovery in each period with treatment. There is no permanent immunity to the infection, so a cured node becomes susceptible again upon recovery. Using the terms defined in Table 1, the differential equation for the SIS model without treatment is
We conclude that, as t , I = N , (4)
where = / and I0 is the initial number of infectious nodes. Therefore, not absolutely all of the population gets infected. This shows that each infectious node infects others with an average value of per unit time.
2. Infection with Treatment
Our optimization model, presented here, takes into account infection and treatment costs. Assuming that filtering treatment is available, infectious can nodes use a level of filtering during each period, which will increase the probability of recovery. The higher the level of filtering, the higher the number of packets which will be processed for treatment and hence the higher the treatment cost. Using (1) and (2), this can be expressed as
dI (t ) = I (t ) S (t ) ( I (t ) Q(t )) Q(t ) , dt
(5)
ETRI Journal, Volume 28, Number 5, October 2006
Jonghyun Kim et al.
693
where > > 0, and I(t) Q(t) 0. Let U(t) denote the number of untreated infectious nodes at time t. Then (5) can be defined by
dI (t ) = I (t ) S (t ) U (t ) Q(t ) , dt
(6)
Pontryagins maximum principle [8], [9]. In order to derive the necessary conditions, we introduce the adjoint variable and the Hamiltonian equation, H. This principle converts (8) and (9) into a problem of minimizing a Hamiltonian, H, for the optimization problem:
H = C I I + C (Q) + [ ( N I ) ( I Q) Q] .
where U(t) = I(t) Q(t). If Q(t) = I(t) in each period, then every node which is infected obtains treatment for infection and (6) becomes
dI (t ) = I (t ) S (t ) Q(t ) . dt
(10)
Furthermore, there exists an adjoint function, (t), such that
(t ) H = = C I ( N 2 I ) , t I
(7)
(11)
Note that if the treatment is very effective, then it may be the case that I = Q, and the infection no longer is epidemic with full treatment, which is called the equilibrium state. The equilibrium of the model with full treatment is the same as that of the model without treatment if the recovery from infection is also very effective.
where the state problem has initial values I(0) = I0 and the adjoint problem has final values (T) = 0. We then have to minimize H over 0 Q I, that is,
H = C (Q) + ( ) = 0 . Q
(12)
IV. Analysis of Optimization Problems
In this section we consider (time dependent) optimal control strategies associated with infection and treatment cost based on the classical SIS model. To determine the appropriate number of nodes to filter, we need to develop a mathematical model of the potential costs involved in infection and treatment at a given time. We will develop cost functions that system administrators can use to help determine an appropriate level of treatment. Our problem is to minimize the total cost of infection and treatment over the finite time period. Our objective function to be minimized is
We denote the marginal cost of treatment as C(Q), then say C(Q) = Q where is equal to the marginal value of an additional unit of the treatment. Suppose Q* is an optimal control for the above problem and I* is the corresponding trajectory so that from (12) the solution for the optimal control is Q*(t) =
( )
*(t), 0 t T .
(13)
Substituting (13) into (9) gives
( ) & I* = I ( N I ) I
2
*, I*(0) = I0
(14) (15)
[C I (t ) + C (Q(t ))]dt ,
T 0 I
(8)
& * = * (2 I N + ) C I , *(T) = 0.
where the control function, Q(t), represents the fraction of total infected nodes consuming treatment (to reduce the number of nodes that may be infectious), subject to the infection equation:
I (t ) = I ( N I ) ( I Q) Q , I(0) = I0 , t
(9)
The optimal control is determined by (13)-(15), that is, we must solve (14) and (15) for optimum trajectory and an adjoint variable. Next, we discuss the numerical solutions of the optimality system and the corresponding optimal control pairs, the parameter choices, and the interpretations.
where , , and are known positive constants and I0 is the known initial infected node.
2. Numerical Results
In this section, we study numerically an optimal treatment strategy for minimizing the total cost of infection since the full dynamic solution of the control problem is usually very difficult and an explicit function-formula does not exist except for very special cases [8], [9]. The optimal treatment strategy is obtained by solving the optimality system, consisting of two differential equations from the state and adjoint equations
1. Necessary Conditions for Optimization
Our objective function balances the effect of minimizing the number of cases implementing the filtering treatments and minimizing the total cost of infection. The necessary conditions that an optimal control variable must satisfy come from
694
Jonghyun Kim et al.
ETRI Journal, Volume 28, Number 5, October 2006
500 400 Q *(t) I *(t) 300 200 100 0 0 20 40 60 80 100
300 250 200 150 100 50 0 0 20 40 60 80 100
effective quarantine techniques, applying our knowledge of cost optimization problems to combating worm infections.
References
[1] E.H. Spafford, The Internet Worm Incident, ESEC89 2nd European Software Engineering Conf., Coventry, UK, 1989. [2] J.O. Kephart and S.R. White, Directed-Graph Epidemiological Models of Computer Viruses, Proc. IEEE Symposium on Security and Privacy, 1991, pp. 343361. [3] F. Cohen, Computer Viruses: Theory and Practice, Computers & Security, vol. 6, Feb. 1987, pp. 2235. [4] C.C. Zou, W. Gong, and D. Towsley, Code Red Worm Propagation Modeling and Analysis, Proc. 9th ACM Conf. on Computer and Communications Security, Nov. 2002, pp. 138 147. [5] C. Wang, J.C. Knight, and M.C. Elder, On Computer Viral Infection and the Effect of Immunization, Proc. 16th Annual Computer Security Applications Conf., 2000, pp. 246256. [6] J. Kim, S. Radhakrishnan, and S.K. Dhall, Measurement and Analysis of Worm Propagation on Internet Network Topology, Proc. 13th Intl Conf. Computer Communications and Networks (IEEE ICCCN2004), Oct. 2004, pp. 495-500. [7] J.C. Frauenthal, Mathematical Modeling in Epidemiology, Springer-Verlag, New York, 1980. [8] G. Knowles, An Introduction to Applied Optimal Control, Academic Press, New York, 1981. [9] M.D. Intriligator, Mathematical Optimization and Economic Theory, Prentice-Hall, Englewood Cliffs, N.J., 1971.
Time t (a)
Time t (b)
Fig. 1. Optimal control strategy as a function of time.
presented in previous section. Figure 1(a) shows that the average number of infected nodes is plotted as a function of time. The graph contains 1000 nodes; the infection, cure, and treated rates are = 1.0, = 0.2, and = 0.8, respectively. In Fig. 1, we assume that the cost weight factor, CI, associated with the number of infected nodes I(t) is less or equal to the marginal cost of treatment, , which is associated with a control Q(t). In Fig. 1, the set of the cost weight factors, CI = 200 and = 500, is chosen to illustrate the optimal treatment strategy. Note that, with treatment, the number of infected nodes eventually reaches almost 50% of the total population, and the infection growth slows down after that. However, without treatment, the number of infected nodes reaches almost 80% of the total population [2], [6]. Figure 1(b) shows that for the optimal treatment strategy, the control Q*(t) is plotted as a function of time with the same parameters as those in Fig. 1(a). This is an expected result because the number of infected nodes consuming a filtering treatment, Q(t), is decreased as the number of infected nodes, I(t), is reduced. In conclusion, the control Q(t) that follows this optimal strategy can effectively reduce the spread of infection and minimize the total cost of infection consisting of both infection and treatment costs.
V. Conclusion
In this letter, we have presented the optimal control problem of minimizing the total cost of Internet worm infection which can be interpreted as the network delay incurred by both infection and treatment. We focus on the application of optimal control theory to minimizing the value of two costs. We have derived the necessary conditions for our optimal control problem which is solved numerically. We have determined that by applying this optimal control strategy, one can very effectively reduce the spread of infection and minimize the total cost of infection. We are also currently working on the development of
ETRI Journal, Volume 28, Number 5, October 2006
Jonghyun Kim et al.
695