|
An attempt has been made to develop a stochastic discrete-time "Vulnerable-Attacked-Infectious-Non-Infectious (VAIN)" model for computer infection with an aim to estimate parameters such as time of attack, incubation time, and mean infection time by using probabilistic approach. VAIN model is basically a compartment-specific approach having distinct boundaries for each compartment. Computer nodes transfer from one compartment to another, such as Vulnerable to Attacked, Attacked to Infectious, and Infectious to Non-Infectious with some stochastic random variables. The probabilities of these random stochastic variables are decided by the Poisson probability distribution. The probabilistic approach is refined by using the data sampling and Bayes' theorem.
Bayes' theorem needs prior or posterior analysis of data, for this maximum likelihood criterion is more helpful to increase the acceptance of the probability. The approximate time of attack, incubation period and infectious period are calculated to suggest proactive measures for cyber defense. Malicious objects such as a virus, worm, Trojan horse, spam, etc., are the major threat to the computer networks through cyber attacks. Different forms of cyber attack threaten an organization's computer and network systems. Such attacks are increasingly becoming more sophisticated and posing greater threats (Chi et al., 2001; and Housholder et al., 2002).
Predicting malicious object outbreaks is extremely difficult due to human nature of the attacks but more importantly, detecting outbreaks early with a low probability of false alarms seems quiet difficult (Mishra and Saini, 2006). By developing models, it is possible to characterize essential properties of attacks. In the malicious attacks, it is difficult to decide the rules because the data are often available at discrete points while the attacking process remains continuous in time. In addition to that the parameters may change with time that leads to the incompleteness of the data at any instance (Henk C Tijms, 1986). According to Radoslavov et al. (2001) and Dall'Astra et al. (2004), it is nevertheless worth noting that a model based on incomplete data may lead to erroneous interpretation of the reality.
|
