PEPA models of Internet worm attacks Jane Hillston. LFCS, - PowerPoint PPT Presentation

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions PEPA models of Internet worm attacks Jane Hillston. LFCS, University of Edinburgh 8th September 2005 Joint work with Jeremy Bradley and Stephen Gilmore Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Outline Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Outline Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Epidemiology ◮ Internet-based computer infections (worms, viruses, etc) are a major concern, particularly to industry. Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Epidemiology ◮ Internet-based computer infections (worms, viruses, etc) are a major concern, particularly to industry. ◮ They results in substantive loss of revenue each year as well as shaking user confidence. Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Epidemiology ◮ Internet-based computer infections (worms, viruses, etc) are a major concern, particularly to industry. ◮ They results in substantive loss of revenue each year as well as shaking user confidence. ◮ The analogy with the spread of real-organism diseases is easy to see. Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Epidemiology ◮ Internet-based computer infections (worms, viruses, etc) are a major concern, particularly to industry. ◮ They results in substantive loss of revenue each year as well as shaking user confidence. ◮ The analogy with the spread of real-organism diseases is easy to see. ◮ Inspired by the work of others, we have chosen to model such spread with a process algebra Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Epidemiology ◮ Internet-based computer infections (worms, viruses, etc) are a major concern, particularly to industry. ◮ They results in substantive loss of revenue each year as well as shaking user confidence. ◮ The analogy with the spread of real-organism diseases is easy to see. ◮ Inspired by the work of others, we have chosen to model such spread with a process algebra ◮ ...incorporating timing aspects with actions with duration and scalability by mapping to ODEs. Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Epidemiology ◮ Internet-based computer infections (worms, viruses, etc) are a major concern, particularly to industry. ◮ They results in substantive loss of revenue each year as well as shaking user confidence. ◮ The analogy with the spread of real-organism diseases is easy to see. ◮ Inspired by the work of others, we have chosen to model such spread with a process algebra ◮ ...incorporating timing aspects with actions with duration and scalability by mapping to ODEs. Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions PEPA S ::= ( α, r ) . S | S + S | A P ::= S | P ✄ ✁ L P | P / L Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions PEPA S ::= ( α, r ) . S | S + S | A P ::= S | P ✄ ✁ L P | P / L ( α, r ) . S designated first action PREFIX: Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions PEPA S ::= ( α, r ) . S | S + S | A P ::= S | P ✄ ✁ L P | P / L ( α, r ) . S designated first action PREFIX: S + S competing components CHOICE: (race policy) Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions PEPA S ::= ( α, r ) . S | S + S | A P ::= S | P ✄ ✁ L P | P / L ( α, r ) . S designated first action PREFIX: S + S competing components CHOICE: (race policy) def = S assigning names CONSTANT: A Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions PEPA S ::= ( α, r ) . S | S + S | A P ::= S | P ✄ ✁ L P | P / L ( α, r ) . S designated first action PREFIX: S + S competing components CHOICE: (race policy) def = S assigning names CONSTANT: A P ✄ ✁ L P α / ∈ L concurrent activity COOPERATION: ( individual actions ) α ∈ L cooperative activity ( shared actions ) Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions PEPA S ::= ( α, r ) . S | S + S | A P ::= S | P ✄ ✁ L P | P / L ( α, r ) . S designated first action PREFIX: S + S competing components CHOICE: (race policy) def = S assigning names CONSTANT: A P ✄ ✁ L P α / ∈ L concurrent activity COOPERATION: ( individual actions ) α ∈ L cooperative activity ( shared actions ) P / L abstraction α ∈ L ⇒ α → τ HIDING: Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Generating a CTMC The corresponding Continuous Time Markov Chain (CTMC) is derived automatically from the structured operational semantics which define the language: Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Generating a CTMC The corresponding Continuous Time Markov Chain (CTMC) is derived automatically from the structured operational semantics which define the language: PEPA MODEL Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Generating a CTMC The corresponding Continuous Time Markov Chain (CTMC) is derived automatically from the structured operational semantics which define the language: SOS rules PEPA ✲ MODEL Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Generating a CTMC The corresponding Continuous Time Markov Chain (CTMC) is derived automatically from the structured operational semantics which define the language: SOS rules LABELLED PEPA TRANSITION ✲ MODEL SYSTEM Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Generating a CTMC The corresponding Continuous Time Markov Chain (CTMC) is derived automatically from the structured operational semantics which define the language: SOS rules LABELLED state transition PEPA TRANSITION ✲ ✲ MODEL diagram SYSTEM Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Generating a CTMC The corresponding Continuous Time Markov Chain (CTMC) is derived automatically from the structured operational semantics which define the language: SOS rules LABELLED state transition PEPA TRANSITION CTMC Q ✲ ✲ MODEL diagram SYSTEM Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks

Introduction Internet worm models Continuous Approximation Quantified analysis Conclusions Generating a CTMC The corresponding Continuous Time Markov Chain (CTMC) is derived automatically from the structured operational semantics which define the language: SOS rules LABELLED state transition PEPA TRANSITION CTMC Q ✲ ✲ MODEL diagram SYSTEM The states of the CTMC are the distinct syntactic terms which the model may evolve to. Jane Hillston. LFCS, University of Edinburgh. PEPA models of Internet worm attacks