Analysis of Intrusion Detection and Attack Proliferation in Computer Networks

Abstract. One of the popular models to describe computer worm propagation is the Susceptible-Infected (SI) model [1]. This model of worm propagation has been implemented on the simulation toolkit Network Simulator v2 (ns-2) [2]. The ns-2 toolkit has the capability to simulate networks of different topologies. The topology studied in this work, however, is that of a simple star-topology. This work introduces our initial efforts to learn the relevant quantities describing an infection given synthetic data obtained from running the ns-2 worm model. We aim to use Bayesian methods to gain a predictive understanding of how computer infections spread in real world network topologies. This understanding would greatly reinforce dissemination of targeted immunization strategies, which may prevent real-world epidemics. The data consist of reports of infection from a subset of nodes in a large network during an attack. The infection equation obtained from [1] enables us to derive a likelihood function for the infection reports. This prior information can be used in the Bayesian framework to obtain the posterior probabilities for network properties of interest, such as the rate at which nodes contact one another (also referred to as contact rate or scan rate). Our preliminary analyses indicate an effective spread rate of only 1/5th the actual scan rate used for a star-type of topology. This implies that as the population becomes saturated with infected nodes the actual spread rate will become much less than the scan rate used in the simulation