Email networks and the spread of computer viruses

1. Email networks and the spread of computer viruses Authors: M. E. J. Newman, S. Forrest, and J. Balthrop. Published: September 10, 2002 - Physical Review E 66 Presenter: Jonathan Hendricker

2. Contributions • Realization of social network of personal connections through a directed network • Provides data about the spread of viruses within social community • More effective way in combating infection through strategic targeting • Applicable to other socially dependant electronic services

3. Outline • The social network – new ground & unique threat • Using a real social network – demographic, testing & results • Experiment Analysis & Prevention techniques: Random vs. Targeted vaccination

4. Social Network • This network is entirely distinct from the physical network of optical fibers and other connections over which data are transferred between computers • Social Network of personal not literal connections to users and computers • Computers do not have to be linked via network, only via personal connections, i.e. Address Books

5. Unique Threat • The PRIMARY vehicle for computer virus transmission is electronic mail. • Viruses are distributed via e-mail attachments and are further propagated through the virus using the user’s Address Book for further targets. • Address Books provide a unique social network of associations not dependant on physical location

6. Testing of Actual Network • 20 Different Types of Address Books • Network of 27,841 total users • Reduced to16,881 active accounts • Any connections from outside the network were omitted though recognized as the viral catalysist

7. Directed Social Network

8. Testing & Results • Number of vertices 16881 • Number with address books 4581 • Number with nonzero in- or out-degrees 10110 • Mean number of entries per address book 12.45 • Mean degree z ~either in or out! 3.38

9. Testing & Results (cont) • Total number of edges 57029 • Number of edges that point both ways 13176 • Fraction pointing both ways ~reciprocity! 0.231

10. Social in & out-degree sampling Results suggest a semi-directed social network

11. Spread of infection over an email network • Pessimistic assumption: virus spread efficiency is 100% • No Anti-virus software or other precautions – Worst Case Scenario • Virus spread is directed through Address Book

12. Who’s at risk? • The users at the highest level of risk are the those in the “strongly connected component” and the “links-out”(out-degree) • Large scale virus infection occurs when there is an infection in the strongly connected component • This tells us that this area is of the most importance for virus protection

13. Random vs. Targeted • Current virus protection strategies focus on random “vaccination” • Ineffective in combating infection, only reduces 10%

14. Weaknesses • Only one network analyzed • Assumption of no anti-virus protection for network too drastic • Statistical equations thrown in with out much explanation • Did not discuss privacy issues or vulnerabilities for determining “Strongly Connected Component” • Alluded to future use but no examples given