Malware Impact Range Estimation via Reverse Propagation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware impact range estimation methods in network systems lack accuracy and impose a significant burden on administrators, as they do not evaluate the infection route from the source and require manual specification of impact ranges.
Innovation Solution
An impact range estimation apparatus and method that calculate reverse propagation probabilities based on scenario information and communications logs, simulating malware propagation to estimate the number of potential sources, reducing administrative burden and improving accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If reverse propagation probability calculation and simulation are performed for each node, then measurement precision of impact range is improved, but device complexity increases
Solution Approach 1:
The system divides the network into individual nodes and calculates reverse propagation probability for each node separately. This segmentation allows precise estimation of malware impact range by evaluating each node's contribution independently, while managing complexity through modular processing of individual nodes rather than treating the entire network as a single unit.
Solution Approach 2:
The system performs reverse propagation probability calculations and simulations in advance before actual malware outbreaks occur. By pre-calculating probabilities based on network topology and communication patterns, the system prepares impact range estimation data that can be quickly applied when malware infections are detected, improving response accuracy without adding real-time complexity.
2Ease of operation
If automatic simulation-based estimation is implemented, then ease of operation is improved, but device complexity increases
Solution Approach 1:
The system automatically performs reverse propagation probability calculations and simulations without requiring administrator intervention. The apparatus independently analyzes communication logs, computes probabilities for each node, and generates impact range estimates autonomously. This self-service capability eliminates manual specification of impact ranges while the automated simulation execution reduces operational burden on administrators.
Solution Approach 2:
The system introduces an automated estimation apparatus as an intermediary between malware detection and impact assessment. This intermediary component handles the complex simulation and probability calculation tasks, translating raw network data into meaningful impact range estimates without requiring administrators to directly perform complex analyses or manual calculations.
Data Source
AI summary
An impact range estimation apparatus 10 estimates a range of impact due to infection by malware in a network system with a plurality of nodes. The impact range estimation apparatus 10 includes: a reverse propagation probability calculation unit 11 configured to, when a specific node is infected with the malware, based on scenario information that specifies a pattern of attack by the malware and a communications log in the network system before infection by the malware, for each node other than the specific node, calculate a probability that the malware propagates from that other node to the specific node; and a simulation execution unit 12 configured to, using the calculated probability, execute a plurality of times a simulation in which the malware is propagated to the specific node, and for each other node, calculate a number of times that that node becomes a propagation source of the malware.