An Epidemic Model of Mobile Phone Vius Hui Zheng, Dong Li, Zhuo Gao 3 Netwok Reseach Cente, Tsinghua Univesity, P. R. China zh@tsinghua.edu.cn School of Compute Science and Technology, Huazhong Univesity of Science and Technology, P. R. China lidong@hust.edu.cn 3 Depatment of Physics, Beijing Nomal Univesity, P. R. China zhuogao@bnu.edu.cn Abstact Consideing the chaacteistics of mobile netwok, we impot thee impotant paametes: distibution density of mobile phone, coveage adius of Bluetooth signal and moving velocity of mobile phone to build an epidemic model of mobile phone vius which is diffeent fom the epidemic model of compute wom. Then analyzing diffeent popeties of this model with the change of paametes; discussing the epidemic theshold of mobile phone vius; pesenting suggestions of quaantining the of mobile phone vius. Keywods: Mobile Phone Vius, Epidemic Model, Secuity of Wieless Netwok, Bluetooth, Smat Phone.. Intoduction The fist compute vius that attacks mobile phone is VBS. Timofonica which was found on May 3, []. This vius speads though PCs, but it can use the message sevice of moviesta.net to send out ubbish shot messages to its subscibe. It is popagandized as mobile phone vius by the media, but in fact it s only a kind of compute vius and can t spead though mobile phone which is the only attacked object. Cabi Cell Phone Wom which was found on June 4, is eally a mobile phone vius []. It speads fom one cell phone to anothe by Bluetooth. Now it is found in moe than counties and has moe than 7 vaiants. Cabi has the chaacteistic of initiative and this patten will be mostly adopted by mobile phone vius in the futue. Table lists the compaison between configuation of smat phone and compute. This table pesents the most advanced desk-top compute configuation in 998 and 999. Geneally, it takes to 3 yeas fo compute with the most advanced configuation to become popula. That is to say, when the Code Red Wom boke out in, common hadwae of computes in Intenet was as same as the configuation in table. With the compaison in table, we can see that smat phone pesently has aleady possessed hadwae condition fo compute vius. Table. Hadwae compaing between smat phone and desk-top pesonal compute Hadwae 5(dop 998 PC 999 PC od 88) CPU Intel 46MHz Pentium 333MHz Pentium III 45MHz[3] Memoy 8M 3M 64M Had Disk G~8G G 6G The development and populaization of smat phone ae both vey fast. Accoding to the statistics of ARC, in 4 the sum of smat phone is 7,,, accounting fo 3% of the global amount of mobile phones. IDC estimates that the sum of smat phone will each up to 3,, by 8 and account fo 5% of the global amount of mobile phones [4]. So we should pay much attention to the secuity of smat phone. In this pape, smat phone is one smat mobile teminal device with the integated ability of data tansmission, pocessing and communication; mobile phone vius is a malicious code that can spead though all kinds of smat mobile teminal devices. As to the secuity eseach, though we can efe to the secuity eseach esults in MANETs (Mobile Ad Hoc Netwoks), MANETs and Senso netwok emphasize that esouce is finite and all the poblems about application and secuity should be esticted to this pecondition []. Smat mobile teminal device emphasizes that esouce is abundant, even possess the same computing ability as desk-top pesonal compute. So fo these two secuity poblems, the stating points of eseach ae diffeent. Recently, pape [5] demonstates that taditional epidemic model of compute vius can t be applied to vius in
mobile envionment and the epidemic model when the mobile phone moves with vaiable velocity is also discussed. But in a small aea, unifom motion accods with the spot law of human being pefeably. What s moe, some impotant paametes such as distibution density and signal coveage adius ae not impoted to the model. Pape [6] compaes to the equied condition of vius in compute and gives the coesponding equied condition of vius in MANETs by simulation. This pape fist discusses seveal modes of mobile phone vius; The second section builds the epidemic model of mobile phone vius which impots 3 paametes: moving velocity, signal coveage adius and distibution density; The thid section analyses some elevant chaacteistics of this model; the fouth section compaes the epidemic model of mobile phone vius with the epidemic model of Intenet wom and discusses the theshold of mobile phone vius beaking out. At last, we make some discussions.. The way of mobile phone vius Though pape [7~8] pesents many examples of mobile phone vius, many of them ae not able to spead, so they ae not eal mobile phone vius. Accoding to analysis of all kinds of epidemic malicious codes which have been found, such as Cabi [], Commwaio [9], Bado [], Skull [] etc, we can define mobile phone vius: it is a piece of data o pogam that speads among smat mobile teminal devices by the communication intefaces and can influence the usage of handset o leak out sensitive data. Though the analysis of way, we can conclude table : Table. Speading way of mobile phone vius Wieless channel Speading distance Speading diection Way of discoveing neighbo nodes Relay (Yes o No) GPRS/CDMA XRTT m Non-diectional Appointed Yes Wi-Fi(8.) m Non-diectional Appointed Yes Bluetooth m Non-diectional Automatic No IDA m Diectional Automatic No Fo the mobile phone vius that can spead by MMS and E-mail, it can tansmit data by GPRS and Wi-Fi; fo the mobile phone vius that spead by electonic file, it can tansmit data by Bluetooth and IDA. Although thee ae fou wieless tansmission ways, some need elay nodes o diectional angle, so Bluetooth is the best choice fo vius wite. In this model, we mainly conside those mobile phone viuses that spead though Bluetooth. Fo othe ways of tansmission, we will build the model in othe papes. 3. The epidemic model of mobile phone popagating Supposing mobile phone has two statuses: Susceptible and infected. The infected will come back to susceptible with cetain pobability. In table 3, we define some symbols: Symbol Ω ρ v I Table 3. Symbol definition Instuctions moving space of mobile phone (-dimmension) distibution density of mobile phone (unifom distibution) moving velocity of mobile phone (unifom velocity) coveage adius of Bluetooth signal The numbe of vius in mobile phone at time t epidemic ate of mobile phone vius popagating esuming ate of the infected Then we can build the epidemic model of mobile phone vius: Ω ρ I = I (( π + v) ρ ) I Ω ρ Suppose: a = ( π + v) ρ ( π + v) ρ b = Ωρ Then the diffeential equation is = ai bi The solution is at + c ae I = at + c + be Fo I ( t ), the initial value of c is a constant. We can conclude fom the solution: if a < then I, and if a >, then a I. b 4. Analysis of model popeties The changes of model popeties with changes of diffeent paametes ae eseached. Table 4 pesents the ange of paametes.
Table 4. The ange of paametes Symbol Instuction Range Ω ρ v I moving space of mobile phone (-dimmension) distibution density of mobile phone (unifom distibution) moving velocity of mobile phone (unifom velocity) coveage adius of Bluetooth signal epidemic ate of mobile phone vius esuming ate of infected The numbe of initial infected mobile phones m * m.~./m m/s m.75.5 4.. Influence of distibution density to vius The connotative subject condition of equation is ρ > ( π + v), mobile phone vius is able to spead when this condition is satisfied. Figue shows the elationship between distibution density and. When the subject condition is not satisfied, is ; when the subject condition is satisfied, the is vey sensitive to the change of distibution density, the small change of distibution density can lead to geat impovement popotion of the infected. 5 5 5 Relationship between ditibution density and.9.36.43.5.57 distibution density.64 Figue. Relationship between distibution density and 4.. Influence of coveage adius to vius Consideing the ange of coveage adius of Bluetooth signal vaies fom 5m to 5m. Distibution density of mobile phone is.5. Figue 3 is the elationship of coveage adius and of the infected, which pesents the influence of coveage adius to vius. Fom these we can see that mobile phone vius can t spead when coveage adius is vey small. If it speads, the will change with coveage adius. Ralationship between coveage adius and.8.6.4.. Relationship of distibution density and.8.5..9.36.43.5 distibution density(numbe of mobile phone in one unit aea Figue. Relationship of distibution density and Figue is the elationship between distibution density and. It shows the influence of distibution density to moving velocity. Mobile phone vius can t spead when distibution density is small. Speading time that the of mobile phone vius gets to equilibium eflects the velocity of vius. Fom these we can see that velocity is vey sensitive to the change of distibution density..8.6.4. 5. 6. 7. 8. 9. coveage adius... 3. 4. 5. Figue 3. Relationship between coveage adius and Figue 4 is the elationship between coveage adius and, it pesents the influence of coveage adius to velocity. Vius can t spead when coveage adius is vey small. Speading velocity is vey sensitive to the changes of coveage adius. 3
Ralationship between coveage adius and 8 6 4 5. 6. 7. 8. 9. Density=.5 coveage adius... 3. 4. 5. Figue 4. Ralationship between coveage adius and 4.3. Influence of moving velocity to vius Assuming distibution density of mobile phone is.35, the ange of moving velocity is m/s~3m/s, figue 5 is the elationship between moving velocity and, it pesents the influence of moving velocity to the of mobile phone vius. Fo the small distibution density of mobile phone and typical coveage adius, speeding the moving velocity can esult in the of the vius which can t spead befoe. Ralationship between moving velocity and infenction.8.6.4.. 6.. Density=.35 6.. moving velocity 6. Figue 5. Relationship between moving velocity and Figue 6 is the elationship between moving velocity and. It pesents the influence of moving velocity to velocity. Fom this figue we can see that inceasing of moving velocity can speed up the of vius. Relationship between moving velocity and 5 5 5. 5.5. Density=.35 4.5 9. moving velocity 3.5 8. Figue 6. Relationship between moving velocity and The time that vius file tansfes fom one mobile phone to anothe is T, the discussion above supposes f that the moving of mobile phone has no influence to vius. If we take into account the influence of moving velocity of mobile phone, we can add one subject condition: v <. When this condition is T f satisfied, vius can spead. When this condition is not satisfied, that is to say, mobile phone moves too fast, then the time that vius stay in the coveage aea of signal is too shot, vius can t spead. 5. Results of compaison with epidemic models of wom The coesponding epidemic model of wom in compute netwok can be expessed as [3]: = I ( Ω ρ I) I In compute netwok, Ω ρ is the sum of compute and it is a fixed value in shot time. The theshold of its is: < Ω ρ. If this condition is satisfied, wom can spead. This condition can be satisfied easily. Diffeent fom the theshold of compute vius, the theshold of mobile phone vius is subject to coveage adius of wieless signal, moving velocity and distibution density. Accoding to the stabilized solution of diffeential equation, we can see: if a <, then I ; fo a = ( π + v) ρ, we can get a new theshold: < ( π + v) ρ. When this condition is satisfied, vius will beak out; if this condition is not satisfied, vius can t beak out. 4
Fom these we can see: the condition that mobile phone vius beaks out is much moe igoous than wom in compute netwok. So the pobability of that mobile phone vius beaks out in lage aea is vey small, but it is possible in local aea. 6. Conclusions Because of the mobility, mobile phone has some elevant chaacteistics: moving velocity, moving scope etc, which make the epidemic model of mobile phone vius vey diffeent fom the model of compute vius and wom. We can make use of stochastic mobile model (such as Random Waypoint model, Random Diection model [4]) to build model of mobile phone vius. But these stochastic models have some limitations and can t accod with the fact pefeably. Fo simplification of this poblem, we build this model with unifom motion. Though the analysis of this model, we can conclude some measues of quaantining mobile phone vius: educing coveage adius, such as educing signal powe, o intefeing signal etc; deceasing moving velocity, such as esticting the flowage of peson; lessening distibution density of mobile phone, such as contolling the moving aea of someone with mobile phone; these measues have distinct diffeences with the usual ways of quaantining mobile phone vius. [6] Robet G. Cole, Nam Phamdo, Moheeb A. Rajab, Andeas Tezis. Requiements on Wom Mitigation Technologies in MANETs. Poceedings of the Wokshop on Pinciples of Advanced and Distibuted Simulation (PADS 5). [7] Shi-an Wang. Pinciple and Defense of Mobile Phone Vius. Jounal of Dal ian Institute of Light Industy, 3(): 74-76, 4. (in Chinese) [8] Kai Li, Hao Chen. Vius Theats to GSM Mobile Phones. China Infomation Secuity, 7:6-8, 5. (in Chinese) [9] Mikko Hypponen, Jano Niemela. F-Secue Vius Desciptions Commwaio. A. Mach 7 th, 5.http://www.fsecue.com/v-descs/commwaio.shtml [] Viuslist-Backdoo. WinCE.Bado, a Viuslist. Aug 5 th, 4. http://www.viuslist. com/en/viuslist.html?id=98455 [] Dan Ilet and Matt Hines. Skulls pogam caies Cabi wom into phones. Techepublic. Nov 3 th, 4. http://techepublic.com /5-_-5474.html [] Sang ho Kim, Choon Seong Leem. Secuity Theats and Thei Countemeasues of Mobile Potable Computing Devices in Ubiquitous Computing Envionments. ICCSA 5, LNCS 3483, pp. 79 85, 5. [3] J. Kephat and S. White. Diected-gaph epidemiological models of compute viuses. In Poceedings of the IEEE Compute Symposium on Reseach in Secuity and Pivacy, pages 343 359, May 99. [4] Bettstette, H. Hatenstein, and X. Peez-Costa. Stochastic Popeties of the Random Waypoint Mobility Model. ACM/ Kluwe Wieless Netwoks, (5):555 567, Septembe 4. Acknowledgement This wok is suppoted in pat by National Science Foundation of China unde contact 634; by High-Tech Pogam (863) of China unde contact 3AA48. Points of view in this document ae those of the authos and do not necessaily epesent the official position of Tsinghua Univesity, Huazhong Univesity of Science and Technology, o Beijing Nomal Univesity. Refeences [] Symantec. VBS.Timofonica. http://www.symantec.com/avcente/venc/data/vbs.timofonica. html [] Symantec. SymbOS.Cabi. http://secuityesponse.symantec.com/avcente/venc/data/sym bos.cabi.html [3] Histoy of Compute Development. http://www.net3.com/4/5-8/344-4.html. (in Chinese) [4] Neal Leavitt. Mobile Phones, The Next Fontie fo Hackes. IEEE Compute, 38(4): -3, 5. [5] James W. Mickens, Bian D. Noble. Modeling Epidemic Speading in Mobile Envionments. WiSE 5, Septembe nd, 5, Cologne, Gemany. 5