Abstract
Modern social worms have been evolving from mass propagation (i.e., blind social worm) to targeted intrusion with the purpose of advanced persistent threats (or APT in short), which concern more on attacking a small number of selected social targets with stealthy propagation (to avoid early exposure caused by a large population of infections), usually at the cost of slow infection speed and thus suffering a long-term propagation period. The resulted propagation characteristics are therefore very different compared to mass infections and cannot be well captured by existing propagation models. In this paper, we take the first step to model social worm propagation for the APT using a novel proactive give-up factor, by which the worm can consult to actively postpone or stop unnecessary infections in order to keep the propagation stealthy (inversely in terms of the size of infected population) and long-term (in terms of the number of infection time epochs), meanwhile maintaining the reachability to the targets (in terms of the connectivity from sources to targets). Our basic idea is to derive such a factor for each node as a give-up probability or a delayed value according to the node’s relative location with respect to sources and targets. We note new infections may lead the relative locations for each node vary, and accordingly model the factor updating upon the propagation progress. To validate our design, we have conducted rigorous theoretical analysis, as well as extensive experiments by running simulated APT worms over the real-world social network topologies. The results have successfully confirmed the effectiveness of our model in simulating APT worm’s propagation with targeted, stealthy and long-term properties altogether.