Dynamic Network Security Deployment Under Partial Information

Transcription

1 Dynamic Network Security Deployment Uner Partial nformation nvite Paper) George Theoorakopoulos EPFL Lausanne, Switzerlan epfl.ch John S. Baras University of Marylan College Park, MD, USA um.eu Jean-Yves Le Bouec EPFL Lausanne, Switzerlan epfl.ch Abstract A network user s ecision to start an continue using security proucts is base on economic consierations. The cost of a security compromise e.g., worm infection) is compare against the cost of eploying an maintaining a sufficient level of security. These costs are not necessarily the real ones, but rather the perceive costs, which epen on the amount of information available to a user at each time. Moreover, the costs whether real or perceive) epen on the ecisions of other users, too: The probability of a user getting infecte epens on the security eploye by all the other users. n this paper, we combine an epiemic moel for malware propagation in a network with a game theoretic moel of the users ecisions to eploy security or not. Users can ynamically change their ecision in orer to maximize their currently perceive utility. We stuy the equilibrium points, an their epenence on the spee of the learning process through which the users learn the state of the network. We fin that the faster the learning process, the higher the total network cost.. NTRODUCTON Mobile evices cellphones, smartphones, pocket PCs, etc.) acquire more an more capabilities in terms of both computation an communication. Processors are getting faster, memory an storage capacity increase, an as a consequence applications for such evices multiply in number an complexity. On the other han, communication interfaces multiply, too: Cellphones use to have only GSM protocol implementations, but now most have also GPRS, UMTS, Bluetooth, an of course many smartphones are WiFi enable. These capabilities have mae mobile evices very popular. Their popularity combine with their capabilities have mae them an attractive target for malware [], []. No user likes his evice to be infecte with malware; on the other han, installing an using security software costs money, battery, CPU resources, an usability. Therefore, users have to make a traeoff between staying unprotecte thus risking infection) an buying protection thus incurring protection costs). To make an informe traeoff, the users nee to estimate the risk of infection, for which they nee to know the size of existing infections if any). The more current the infection information is, the better the cost optimization that the users can o. A mobile operator can warn users for currently ongoing infections. Shoul it? How frequently? The operator wants to reuce the total network cost, but the users want to reuce their personal expecte cost. Are these two objectives aligne? These questions have not been aequately aresse. Traitionally, research has focuse on moeling only the propagation of worms, in the nternet [3], [4], [5], an also in mobile networks [6], [7], [8], among others. Research that goes beyon moeling propagation to moel countermeasures has not explicitly taken into account the users freeom to install protection or not. The ecision to eploy countermeasures was assume to be taken unilaterally by the operator e.g., [9]) or, at any rate, always accepte by the users e.g., [], []). The work most similar to ours [] has only moele static ecisions, where users ecie once an for all. At the same time, users are assume to have perfect knowlege of all relevant parameters, an also perfect reasoning capabilities. The main moeling novelty in the present work is the combination of a worm propagation moel with a game theoretic process which involves learning) that etermines users actions: The users maximize their perceive personal cost through their ecision to install or uninstall protection an this ecision epens on the information that the users possess about the state of the network. That information is given to them at some upate rate from the operator. Consequently, it is not current at all times, since the network state changes, first, because of the propagation of the worm, an, secon, because of the ecisions of other users. Also, our users o not take into account the effect that their actions will have on the network state, an therefore on the future actions of other users. n that, they have limite reasoning capabilities. We fin game theoretic equilibria, which are stable in the sense that if a small proportion of the population changes strategy, or if a small proportion of infecte users enters the population, then the ynamics of the system lea it back to the stable equilibrium point. Our main fining is that the total cost to the network increases as the upate rate increases. The rest of the paper is organize as follows: n Section, we escribe the system moel, the two components of which are the epiemic worm propagation, an the game theoretic ecision making proceure. Section presents the results about the equilibrium points an their stability, an

2 Section V conclues with some practical interpretation of our results. More etaile erivations of the results are in the Appenix.. SYSTEM MODEL List of Variables β contact rate per user per time unit upate rate rate of learning from the monitor) rate of recovery from the infection N total number of users N ) S fraction of Susceptible users in the network fraction of nfecte users in the network P fraction of Protecte users in the network c cost of infection c P cost of protection p SP ) Probability that a Susceptible user switches to Protecte when learning see Eq. 3)) p P S ) Probability that a Protecte user switches to Susceptible when learning p P S ) = p SP )) ɛ shape parameter of p SP ) ) position parameter of p SP ), = c P c < TABLE LST OF VARABLES A. Epiemic-base Worm Propagation Moel We assume a network with N users, an the total contact rate is βn contacts per time unit in the whole network, where β > is constant with respect to N. So, a given user makes β contacts per time unit, an a given pair makes N contacts per time unit. Each user can be at each time instant t in one of three states: Susceptible S), nfecte ), Protecte P). We enote St), t), P t) the respective percentages St) + t) + P t) = ; the time epenence will not be explicitly given in the rest of the paper). A worm propagates in the network, infecting susceptible users. The infection lasts for a ranom amount of time, exponentially istribute with parameter >. While being infecte, a user infects other susceptible users he contacts. After the infection is over, the user becomes protecte. For the worm behavior escribe above, we use the stanar SR moel [3], which we will call SP P for Protecte): t S = S a) = S t b) t P = c) B. Game Theoretic Decision Making The non-infecte users S an P) can choose whether to remain in their current state or switch to the other state. Their choice epens on the risk of getting infecte versus the cost of protection. The cost of protection is fixe at c P <, but the risk of getting infecte epens on the infection cost c < c P < an also on the percentage of infecte users in the network. We efine the total network cost to be the quantity C, P ) = c + c P P. ) We encoe these consierations in the following game escription. There are two player types: Type is noninfecte, an Type is infecte. We are intereste in the viewpoint of a Type player. The players are matche at ranom, so the probability that a given Type player will meet a Type player is equal to the percentage of the infecte users. The Type versus Type player game is: S P S, ), c P ) P c P, ) c P, c P ) an the Type versus Type player game is: S c, ) P c P, ) where we omit the payoffs of the Type infecte) player. f the non-infecte players know the fraction, they can choose their best response as follows: Choose S if c > c P < c P c, an P otherwise. The users nee to learn the value of. For the learning process, we assume there is a centralize service for monitoring the network, which knows instantly the current percentage of infecte users in the network. The users contact the service at rate times per time unit, an learn the value of. As a consequence, the users o not know the exact value of at all times. More importantly, it has been observe [4, Ch. 4] that when aske to choose between two alternatives, behavior is ranom, becoming more eterministic when the two alternatives become more istinct. n our case, more istinct translates to larger utility ifference. To moel this ranom aspect of the users behavior, we assume that a user switches from S to P with probability p SP ), an from P to S with probability p P S ). We set p SP ) to be the following piecewise linear function see Fig. ): < ɛ p SP ) = ɛ + ɛ ) ɛ < < + ɛ > + ɛ an p P S ) = p SP ). For ɛ, this function becomes a pure best response function. For ɛ > it is a smoothe best response. The best response an smoothe best response ynamics are common moels for the learning behavior of game theoretic users [4, Ch. 3 an 4]. C. Learning Through Centralize Monitoring: The Complete Moel The users learn the percentage of infecte users at rate, the upate rate, which leas to the following system: t S = S Sp SP ) + P p P S ) = S t 4b) t P = + Sp SP ) P p P S ) 3) 4a) 4c)

3 Switching probability psp) ɛ = ɛ + ɛ Fraction of infecte users S X Fig.. The probability that a Susceptible user switches to being Protecte, when learning the fraction of nfecte users in the network. Note that one of the three equations is reunant, since we know that S + + P = at all times. We keep the first two, together with S + + P =, from which we substitute P into the first one. D. Mathematical Moels Our moel i.e., the system 4)) escribes an evolutionary game on the simplex in R 3, since S + + P = [5]. Such games on the simplex have been intensively stuie over the last twenty years as they are very relevant for biological an social population ynamics, e.g., replication ynamics [5], [6], [7], [8], [9], [], []. More specifically, it is possible to stuy the ynamics an equilibria of our moel globally using the methos of [5], [6], [7], [8], [9], [], [], which originate in the seminal work of Shahshahani [5]. The methos involve inclue Lie-algebraic conitions, potential games an Lyapunov functions. t is also possible to view our moel as a switching system see [], [3], [4], as examples) on the simplex in R 3, where the switching controls are the probabilities, p SP.) an p P S.); actually only one is neee. Then one can formulate more general ynamic games where these controls can epen on the past history of t) in various ways. Other formulations can be also stuie where the whole problem is consiere in either finite or infinite time, as a stochastic game with switching strategies, still on the simplex in R 3. All these more general frameworks an formulations are consiere in our forthcoming paper [5].. RESULTS: EQULBRUM PONTS AND STABLTY Our main fining is Fig.. The vector fiel of the system 4) for the case >. At the point S, ), an arrow parallel to S t, ) is plotte. The only equilibrium point t is X =, ). t is also stable. Theorem. n the stable equilibrium points of our system, the total network cost C, P ) monotonically ecreases with the upate rate. So, the value of that minimizes C, P ) is opt =. n this section we state our finings about the equilibrium points an their stability. The erivations are in the Appenix. We look for equilibrium points by solving the system: = S Sp SP ) + P p P S ) 5a) = S 5b) = S + + P 5c) f >, the only equilibrium point is X = S,, P ) =,, ) 6) an it is stable. The vector fiel of the system 4) corresponing to the conition > is shown in Fig. f <, the point X is still an equilibrium point but it is no longer stable. Now, there are two new potential equilibrium points: X = S,, P ) =, +, ) + 7) an X = S,, P ) =,, ), 8) where is the smallest solution of the equation ɛ + ɛ ) + + +ɛ ) + ɛ =. 9)

4 = = + X = + = X S = S X S = S X Fig. 3. The vector fiel of the system 4) for the case < an < ɛ S. At the point S, ), an arrow parallel to + t, t ) ) is plotte. The point X =,, + + is an equilibrium point an it is stable. The point X =, ) is also an equilibrium point but it is unstable. We can see that all trajectories converge to X, except those that start on the axis =, which converge to X. Fig. 4. The vector fiel of the system 4) for the case < an > + ɛ S. At the point S, ), an arrow parallel to t, ) is plotte. The t point X =,, ) for the value of see )) is a stable equilibrium point, always within ɛ below see Appenix). The point X =, ) is also an equilibrium point but it is unstable. We can see that all trajectories converge to X, except those that start on the axis =, which converge to X. That is, = ɛ + ɛ + + ɛ + ɛ + + ) 4 ɛ ) ) +. ) The point X exists an is stable if an only if in aition to < ) + < ɛ. ) Otherwise, the point X exists an is stable. Figures 3 an 4 show the vector fiels of the system 4) in the two cases where X an X, respectively, exist an are stable. The stability in all cases was checke through the evaluation of the Jacobian at each point. n all cases, the Jacobian ha eigenvalues with negative real part. n the case of X an X, there can be an imaginary part for some values of the parameters, so we have iminishing oscillations spiral). n particular, we have a spiral aroun X when β is close enough to + ), an aroun X when ɛ is small enough. Note that the evaluation of the Jacobian proves local stability i.e., if the perturbation from the equilibrium point is small enough, the system returns to it). However, the figures imply global stability, that is, the system returns to the unique for each combination of parameters) regarless of the initial conitions, or the size of the perturbation away from the equilibrium point. The only exception is when the system starts on the = axis, in which case it converges to the unstable point X. We inee investigate an establish global stability results for this problem in [5]. We can now prove Theorem that network cost in the equilibrium points X, X, X increases with ) by ifferentiating an with respect to. At the point X, the value = oes not epen on, an so the network cost in that case is for all values of. = = + ) ) + >, ) To fin we ifferentiate 9), which satisfies, with respect to : ɛ + ɛ ) ɛ ) + ɛ =

5 + ɛ ɛ + ɛ ɛ + ɛ + + ) = + + )) + ɛ = 3) We know that < an < + ɛ. So, ɛ + ɛ + + ) is always negative. t follows that >,. 4) From ) an 4) we conclue that >,. Recalling that S = S =, we can see that the total network cost increases with, proving Theorem : C, P ) = c + c P P = c + c P ) = c c P ) + c P ) C, P ) C, P ) = c c P ) >, 5) V. CONCLUSON The users ability to switch from P to S, an vice versa, leas to a sustaine infection level enemic), if <. The actual fraction of the at the equilibrium point which is proportional to the total network cost) increases monotonically with the upate rate. This counterintuitive conclusion is an instance of the price of anarchy phenomenon: The iniviually rational outcome large implies more current information available to the users) is worse than the socially optimal outcome. The conflict between network optimality an iniviual optimality creates a ilemma for the operator. Not notifying the users might be interprete as trying to manipulate them into buying unnecessary protection. Acquiescing to their emans an upating them as quickly as possible woul be both expensive in terms of, e.g., monitoring infrastructure, an total network cost, as we have proven. Therefore, a sensible compromise seems to be for the operator to shouler at least part of the protection costs, perhaps as part of the package offere to users. ACKNOWLEDGMENT The research of the secon author was supporte by the Communications an Networks Consortium sponsore by the U.S. Army Research Laboratory uner the Collaborative Technology Alliance Program, Cooperative Agreement DAAD9---, by the U.S. Army Research Office uner MUR awar W 9 NF 787, an by the MAST Consortium sponsore by the U.S. Army Research Laboratory uner the Collaborative Technology Alliance Program, Cooperative Agreement W9NF REFERENCES [] M. Hypponen, Malware goes mobile, Scientific American, pp. 7 77, November 6. [] J. Kleinberg, Computing: The wireless epiemic, Nature, vol. 449, no. 76, pp , September 7, biological connection. [3] J. Kephart an S. White, Directe-graph epiemiological moels of computer viruses, Research in Security an Privacy, 99. Proceeings., 99 EEE Computer Society Symposium on, pp , - May 99. [4] J. O. Kephart an S. R. White, Measuring an moeling computer virus prevalence, in SP 93: Proceeings of the 993 EEE Symposium on Security an Privacy. Washington, DC, USA: EEE Computer Society, 993, p.. [5] C. C. Zou, W. Gong, an D. Towsley, Coe re worm propagation moeling an analysis, in CCS : Proceeings of the 9th ACM conference on Computer an communications security. New York, NY, USA: ACM,, pp [6] C. Fleizach, M. Liljenstam, P. Johansson, G. M. Voelker, an A. Mehes, Can you infect me now?: malware propagation in mobile phone networks, in WORM 7: Proceeings of the 7 ACM workshop on Recurring malcoe. New York, NY, USA: ACM, 7, pp [7] H. Zheng, D. Li, an Z. Gao, An epiemic moel of mobile phone virus, Pervasive Computing an Applications, 6 st nternational Symposium on, pp. 5, 3-5 Aug. 6. [8]. Carreras, D. Miorani, G. S. Canright, an K. Engo-Monsen, Unerstaning the sprea of epiemics in highly partitione mobile networks, in BONETCS 6: Proceeings of the st international conference on Bio inspire moels of network, information an computing systems. New York, NY, USA: ACM, 6, p.. [9] S. Sarat an A. Terzis, On using mobility to propagate malware, in Proceeings of the 5th nternational Symposium on Moeling an Optimization in Mobile, A Hoc, an Wireless Network WiOpt), April 7. [] M. Bloem, T. Alpcan, an T. Başar, Optimal an robust epiemic response for multiple networks, in Proc. 46th EEE Conference on Decision an Control, New Orleans, LA, December 7. [Online]. Available: papers/cc7patching.pf [] M. Costa, J. Crowcroft, M. Castro, A. Rowstron, L. Zhou, L. Zhang, an P. Barham, Vigilante: en-to-en containment of internet worms, in SOSP 5: Proceeings of the twentieth ACM symposium on Operating systems principles. New York, NY, USA: ACM, 5, pp [] M. Lelarge an J. Bolot, Network externalities an the eployment of security features an protocols in the internet, in SGMETRCS 8: Proceeings of the 8 ACM SGMETRCS international conference on Measurement an moeling of computer systems. New York, NY, USA: ACM, 8, pp [3] W. O. Kermack an A. G. McKenrick, A contribution to the mathematical theory of epiemics, Proceeings of the Royal Society of Lonon. Series A, Containing Papers of a Mathematical an Physical Character, vol. 5, no. 77, pp. 7 7, 97. [Online]. Available: [4] D. Fuenberg an D. K. Levine, The Theory of Learning in Games. MT Press, May 998. [5] S. Shahshahani, A new mathematical framework for the stuy of linkage an selection, Memoirs of the American Mathematical Society, 979. [6] E. Akin, The ifferential geometry of population genetics an evolutionary games, in Mathematical an Statistical Developments of Evolutionary Theory, S. Lessar, E. Dorrecht: Kluwer, 99, pp. 93. [7] D. Monerer an L. Shapley, Potential games, Games an Economic Behavior, vol. 4, pp. 4 43, 996. [8] W. Sanholm, Evolution an equilibrium uner inexact information, Games an Economic Behavior, vol. 44, pp , 3. [9] T. Roughgaren, Selfish Routing an the Price of Anarchy. Cambrige, Mass.: MT Press, 5. [] W. Sanholm an R. Lahkar, The projection ynamic an the geometry of population games, Games an Economic Behavior, 8. [] W. Sanholm, E. Dokumaci, an R. Lahkar, The projection ynamic an the replicator ynamic, Games an Economic Behavior, 8. []. Matei, N. Martins, an J. Baras, Optimal linear quaratic regulator for markovian jump linear systems, in the presence of one stop-time

6 step elaye moe observations, in Proceeings of the 7th FAC Worl Congress, Seoul, Korea, July 8. [3], Almost sure convergence to consensus in markovian ranom graph, in Proceeings of 8 EEE Conference on Decision an Control, December 8. [4], A consensus problem for markovian ranom graphs, 8, submitte for publication. [5] G. Theoorakopoulos, J. Baras, an J.-Y. Le Bouec, Dynamic network security eployment uner partial information: Global analysis, 8, in preparation. APPENDX We fin the equilibrium points X, X, X by solving the system 4) in the three ifferent regions of specifie in the function p SP : < ɛ, ɛ < < + ɛ, > + ɛ. We then verify that the solutions are in the proper region. For each case, we solve the respective simple system that results: > + ɛ The system becomes: = S S 6a) = S ) 6b) = S + + P 6c) The only solution is S,, P ) =,, ), but this contraicts the assumption > + ɛ. Note that the solution with S = leas to a negative value for. < ɛ The system becomes: = S + S ) 7a) = S ) 7b) = S + + P 7c) This system has the solutions: X = S,, P ) =,, ) 8) X = S,, P ) =, +, ) + 9). The secon solution, X, is amissible if an only if an also + < ɛ ). ) Note that if =, the two points coincie, so we on t nee to stuy X separately in this case. We now examine whether X an X are locally) stable equilibrium points. The Jacobian of the system of the first two equations is ) S JS, ) = S We evaluate the Jacobian at the point X : ) JX ) = J, ) = ) 3) The eigenvalues of JX ) are an. So, X is stable if an only if <, in which case note that X oes not exist. We evaluate the Jacobian at the point X : JX ) = J, ) + = + 4) + + The eigenvalues of JX ) are a ± a +4a a, where a ij are the elements of JX ) a = ). Since a <, the smallest eigenvalue is always negative. The largest one is negative if an only if a a < >. So X is stable whenever it exists. f we evaluate the square root a + 4a a at the point β = + ), we see that its argument can also take negative values. Since the eigenvalues are a continuous function of β, they will have an imaginary part for β close to + ), which means that the trajectories spiral towars X. ɛ < < + ɛ The system becomes: = S S + ɛ ) ɛ + S ) ɛ = S ) + ɛ ) ) 5a) 5b) = S + + P 5c) n the secon equation the only amissible solution is S =. For this value of S, the first equation gives the following quaratic equation for : ɛ + ɛ ) + + +ɛ ) + ɛ = 6) Defining f) to be the quaratic form above, we see that f an ɛ ) = ɛ + ) ɛ ) ) 7) f + ɛ ) = ɛ + ɛ + ). 8) So, f + ɛ ) is always negative, an f ɛ ) is positive if an only if ) is not satisfie. That is, a solution for exists an consequently the point X exists) if an only if X oes not exist. The exact value of is given in ). By evaluating f ) an using ), we get that f ) <, so actually ɛ, ). The Jacobian of the system of the first two equations is S JS, ) = ɛ + + ɛ ) ) S 9)

7 ) We evaluate the Jacobian at the point X =,. JX ) = ɛ + + ɛ ) ) 3) The eigenvalues of JX ) are α ± α +4α α, where α ij are the elements of JX ) α = ). Since α <, the smallest eigenvalue is always negative. The largest one is negative if an only if α α <. But α >, an α = ɛ + + ɛ ), which is always negative since < an < + ɛ. So the largest eigenvalue is also always negative, an therefore X is stable whenever it exists. Since lim ɛ + α =, we can see that for small enough values of ɛ the eigenvalues have an imaginary part, which causes the trajectories to spiral towars X.