Analysing distributed internet worm attacks using continuous state-space approximation of process algebra models.

*(English)*Zbl 1154.68318Summary: Internet worms are classically described using SIR models and simulations, to capture the massive dynamics of the system. Here we are able to generate a differential equation-based model of infection based solely on the underlying process description of the infection agent model. Thus, rather than craft a differential equation model directly, we derive this representation automatically from a high-level process model expressed in the PEPA process algebra. This extends existing population infection dynamics models of Internet worms by explicitly using frequency-based spread of infection. Three types of worm attack are analysed which are differentiated by the nature of recovery from infection and vulnerability to subsequent attacks.

To perform this analysis we make use of continuous state-space approximation, a recent breakthrough in the analysis of massively parallel stochastic process algebra models. Previous explicit state-representation techniques can only analyse systems of order \(10^{9}\) states, whereas continuous state-space approximation can allow analysis of models of \(10^{10000}\) states and beyond.

To perform this analysis we make use of continuous state-space approximation, a recent breakthrough in the analysis of massively parallel stochastic process algebra models. Previous explicit state-representation techniques can only analyse systems of order \(10^{9}\) states, whereas continuous state-space approximation can allow analysis of models of \(10^{10000}\) states and beyond.

##### MSC:

68M10 | Network design and communication in computer systems |

68Q85 | Models and methods for concurrent and distributed computing (process algebras, bisimulation, transition nets, etc.) |

PDF
BibTeX
XML
Cite

\textit{J. T. Bradley} et al., J. Comput. Syst. Sci. 74, No. 6, 1013--1032 (2008; Zbl 1154.68318)

Full Text:
DOI

##### References:

[1] | L. Bortolussi, Constraint-based approaches to stochastic dynamics of biological systems, PhD thesis, University of Udine, 2007 |

[2] | Bowman, Howard; Bryans, Jeremy W.; Derrick, John, Analysis of a multimedia stream using stochastic process algebras, Comput. J., 44, 4, 230-245, (2001) · Zbl 0993.68068 |

[3] | Bradley, Jeremy T.; Dingle, Nicholas J.; Gilmore, Stephen T.; Knottenbelt, William J., Derivation of passage-time densities in PEPA models using ipc: the imperial PEPA compiler, (), 344-351 |

[4] | Jeremy T. Bradley, Jane Hillston, Using ODEs and continuous state-space approximation to analyse massively parallel process algebra models, Theoret. Comput. Sci. (2007), submitted for publication |

[5] | Muffy Calder, Stephen Gilmore, Jane Hillston, Automatically deriving ODEs from process algebra models of signalling pathways, in: Gordon Plotkin (Ed.), Proceedings of Computational Methods in Systems Biology, CMSB 2005, Edinburgh, Scotland, April 2005, pp. 204-215 · Zbl 1185.92041 |

[6] | Cardelli, L., From processes to ODEs by chemistry, 22/04/07, (2006) |

[7] | Dormand, J.R.; Prince, P.J., A family of embedded runge – kutta formulae, J. comput. appl. math., 6, 19-26, (1980) · Zbl 0448.65045 |

[8] | Forneau, J.M.; Kloul, L.; Valois, F., Performance modelling of hierarchical cellular networks using PEPA, Perform. eval., 50, 2-3, 83-99, (November 2002) |

[9] | Gilmore, S.; Hillston, J.; Ribaudo, M., An efficient algorithm for aggregating PEPA models, IEEE trans. softw. engrg., 27, 5, 449-464, (2001) |

[10] | Hillston, Jane, A compositional approach to performance modelling, Disting. diss. comput. sci., vol. 12, (1996), Cambridge University Press · Zbl 1080.68003 |

[11] | Hillston, Jane, Fluid flow approximation of PEPA models, (), 33-42 · Zbl 1111.68014 |

[12] | Holton, D.R.W.; Gilmore, Stephen; Hillston, Jane, A PEPA specification of an industrial production cell, Process algebra and performance modelling workshop, Special Issue: CEPIS, Edinburgh, Comput. J., 38, 7, 542-551, (June 1995) |

[13] | Kwiatkowska, M.; Norman, G.; Parker, D., PRISM: probabilistic symbolic model checker, (), 200-204 · Zbl 1047.68533 |

[14] | Liljenstam, Michael; Nicol, David M.; Berk, Vincent H.; Gray, Robert S., Simulating realistic network worm traffic for worm warning system design and testing, () |

[15] | Liljenstam, Michael; Yuan, Yougu; Premore, B.J.; Nicol, David, A mixed abstraction level simulation model of large-scale Internet worm infestations, () |

[16] | Nicol, David; Liljenstam, Michael; Liu, Jason, Multiscale modeling and simulation of worm effects on the Internet routing infrastructure, () |

[17] | Norman, R.; Shankland, C., Developing the use of process algebra in the derivation and analysis of mathematical models of infectious disease, (), 404-414 |

[18] | D. Sumpter, From bee to society: An agent-based investigation of honey bee colonies, PhD thesis, UMIST, 2000 |

[19] | Thomas, Nigel; Bradley, Jeremy T.; Knottenbelt, William J., Stochastic analysis of scheduling strategies in a GRID-based resource model, IEE softw. engrg., 151, 5, 232-239, (September 2004) |

[20] | Tofts, C., Describing social insect behaviour using process algebra, Trans. soc. comput. simul., 10, 227-283, (1992) |

[21] | TrendMicro, The SASSER event: history and implications, (June 2004), Technical report |

This reference list is based on information provided by the publisher or from digital mathematics libraries. Its items are heuristically matched to zbMATH identifiers and may contain data conversion errors. It attempts to reflect the references listed in the original paper as accurately as possible without claiming the completeness or perfect precision of the matching.