skip to main content
10.1145/1811039.1811063acmconferencesArticle/Chapter ViewAbstractPublication PagesmetricsConference Proceedingsconference-collections
research-article

Detecting sources of computer viruses in networks: theory and experiment

Published: 14 June 2010 Publication History

Abstract

We provide a systematic study of the problem of finding the source of a computer virus in a network. We model virus spreading in a network with a variant of the popular SIR model and then construct an estimator for the virus source. This estimator is based upon a novel combinatorial quantity which we term rumor centrality. We establish that this is an ML estimator for a class of graphs. We find the following surprising threshold phenomenon: on trees which grow faster than a line, the estimator always has non-trivial detection probability, whereas on trees that grow like a line, the detection probability will go to 0 as the network grows. Simulations performed on synthetic networks such as the popular small-world and scale-free networks, and on real networks such as an internet AS network and the U.S. electric power grid network, show that the estimator either finds the source exactly or within a few hops in different network topologies. We compare rumor centrality to another common network centrality notion known as distance centrality. We prove that on trees, the rumor center and distance center are equivalent, but on general networks, they may differ. Indeed, simulations show that rumor centrality outperforms distance centrality in finding virus sources in networks which are not tree-like.

References

[1]
The CAIDA AS relationships dataset. http://www.caida.org/data/active/as--relationships, August 30th, 2009.
[2]
N. T. J. Bailey. The Mathematical Theory of Infectious Diseases and its Applications. Griffin, London, 1975.
[3]
A. Barabasi and R. Albert. Emergence of scaling in random networks. Science, 286:509--512, 1999.
[4]
P. Bonacich. Power and centrality: A family of measures. American Journal of Sociology 92:1170{1182, 1987.
[5]
L. C. Freeman. A set of measure of centrality based on betweenness. Sociometry, 40:35--41, 1977.
[6]
A. Ganesh, L. Massoulie, and D. Towsley. The effect network topology on the spread of epidemics. Proc 24th Annual Joint Conference of the IEEE Computer and Communications Societies (INFOCOM 2:1455--1466, 2005.
[7]
C. Moore and M. E. J. Newman. Epidemics and percolation in in small-world networks. Phys. Rev. E, 61:5678--5682, 2000.
[8]
M. E. J. Newman. The spread of epidemic disease on networks. Phys. Rev. E, 66:016128, 2002.
[9]
H. Okamura, K. Tateishi, and T. Doshi. Statistical inference of computer virus propagation using non-homogeneous poisson processes. Proc. 18th IEEE International Symposium on Software Reliability, 5:149--158, 2007.
[10]
R. Pastor-Satorras and A. Vespignani. Epidemic spreading in scale-free networks. Phys. Rev. Lett., 6:3200--3203, 2001.
[11]
G. Sabidussi. The centrality index of a graph. Psychometrika, 31:581--603, 1966.
[12]
G. Streftaris and G. J. Gibson. Statistical inference for stochastic epidemic models. Proc. 17th international Workshop on Statistical Modeling, pages 609--616, 2002.
[13]
D. J. Watts and S. Strogatz. Collective dynamics of `small--world' networks. Nature, 393:440--442, 1998.

Cited By

View all
  • (2025)Diffusion Source Inference for Large-Scale Complex Networks Based on Network PercolationIEEE Transactions on Neural Networks and Learning Systems10.1109/TNNLS.2023.332176736:1(1453-1466)Online publication date: Jan-2025
  • (2025)Theoretical Guarantees for Sparse Graph Signal RecoveryIEEE Signal Processing Letters10.1109/LSP.2024.351480032(266-270)Online publication date: 2025
  • (2024)Efficient Recovery of Sparse Graph Signals From Graph Filter OutputsIEEE Transactions on Signal Processing10.1109/TSP.2024.349522572(5550-5566)Online publication date: 1-Jan-2024
  • Show More Cited By

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences
SIGMETRICS '10: Proceedings of the ACM SIGMETRICS international conference on Measurement and modeling of computer systems
June 2010
398 pages
ISBN:9781450300384
DOI:10.1145/1811039
  • cover image ACM SIGMETRICS Performance Evaluation Review
    ACM SIGMETRICS Performance Evaluation Review  Volume 38, Issue 1
    Performance evaluation review
    June 2010
    382 pages
    ISSN:0163-5999
    DOI:10.1145/1811099
    Issue’s Table of Contents
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 14 June 2010

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. epidemics
  2. estimation

Qualifiers

  • Research-article

Conference

SIGMETRICS '10
Sponsor:

Acceptance Rates

Overall Acceptance Rate 459 of 2,691 submissions, 17%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)78
  • Downloads (Last 6 weeks)4
Reflects downloads up to 20 Feb 2025

Other Metrics

Citations

Cited By

View all
  • (2025)Diffusion Source Inference for Large-Scale Complex Networks Based on Network PercolationIEEE Transactions on Neural Networks and Learning Systems10.1109/TNNLS.2023.332176736:1(1453-1466)Online publication date: Jan-2025
  • (2025)Theoretical Guarantees for Sparse Graph Signal RecoveryIEEE Signal Processing Letters10.1109/LSP.2024.351480032(266-270)Online publication date: 2025
  • (2024)Efficient Recovery of Sparse Graph Signals From Graph Filter OutputsIEEE Transactions on Signal Processing10.1109/TSP.2024.349522572(5550-5566)Online publication date: 1-Jan-2024
  • (2024)Random Full-Order-Coverage Based Rapid Source Localization With Limited Observations for Large-Scale NetworksIEEE Transactions on Network Science and Engineering10.1109/TNSE.2024.340639411:5(4213-4226)Online publication date: Sep-2024
  • (2024)Distributed Rumor Source Detection via Boosted Federated LearningIEEE Transactions on Knowledge and Data Engineering10.1109/TKDE.2024.339023836:11(5986-6001)Online publication date: Nov-2024
  • (2024)FROST: Controlled Label Propagation for Multisource DetectionIEEE Transactions on Computational Social Systems10.1109/TCSS.2024.339093111:5(6217-6228)Online publication date: Oct-2024
  • (2024)The Impact of Adversarial Node Placement in Decentralized Federated Learning NetworksICC 2024 - IEEE International Conference on Communications10.1109/ICC51166.2024.10622678(1679-1684)Online publication date: 9-Jun-2024
  • (2024)A fast algorithm for diffusion source localization in large-scale complex networksJournal of Complex Networks10.1093/comnet/cnae01412:2Online publication date: 17-Mar-2024
  • (2023)Inference of a rumor's source in the independent cascade modelProceedings of the Thirty-Ninth Conference on Uncertainty in Artificial Intelligence10.5555/3625834.3625849(152-162)Online publication date: 31-Jul-2023
  • (2023)Privacy-Enhancing Digital Contact Tracing with Machine Learning for Pandemic Response: A Comprehensive ReviewBig Data and Cognitive Computing10.3390/bdcc70201087:2(108)Online publication date: 1-Jun-2023
  • Show More Cited By

View Options

Login options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Figures

Tables

Media

Share

Share

Share this Publication link

Share on social media