NET Institute*

Transcription

1 NET Institute* Working Paper #08-24 October 2008 Computer Virus Propagation in a Network Organization: The Interplay between Social an Technological Networks Hsing Kenny Cheng an Hong Guo Warrington College of Business Aministration University of Floria * The Networks, Electronic Commerce, an Telecommunications ( NET ) Institute, is a non-profit institution evote to research on network inustries, electronic commerce, telecommunications, the Internet, virtual networks comprise of computers that share the same technical stanar or operating system, an on network issues in general. 1

2 Computer Virus Propagation in a Network Organization: The Interplay between Social an Technological Networks 1 Hsing Kenny Cheng Department of Information Systems an Operations Management Warrington College of Business Aministration The University of Floria, Gainesville, FL hkcheng@ufl.eu Hong Guo Department of Information Systems an Operations Management Warrington College of Business Aministration The University of Floria, Gainesville, FL guohong@ufl.eu This paper proposes a holistic view of a network organization s computing environment to examine computer virus propagation patterns. We empirically examine a large-scale organizational network consisting of both social network an technological network. By applying information retrieval techniques, we map noes in the social network to noes in the technological network to construct the composite network of the organization. We apply social network analysis to stuy the topologies of social an technological networks in this organization. We statistically test the impact of the interplay between social an technological network on computer virus propagation using a susceptible-infective-recovere epiemic process. We fin that computer viruses propagate faster but reach lower level of infection through technological network than through social network, an viruses propagate the fastest an reach the highest level of infection through the composite network. Overlooking the interplay of social network an technological network unerestimates the virus propagation spee an the scale of infection. Key wors: social network analysis, interplay between social an technological networks, computer viruses 1 We gratefully acknowlege financial support from the NET Institute ( an the Kauffman Founation. 2

3 1. Introuction Network organizations rely on various interconnecte networks to achieve higher operational efficiency an more flexible management (Sproull an Kiesler 1991, Van Alstyne 1997). Business partners incluing ifferent manufacturers, suppliers, an istributors form a supply chain network in orer to reach their customers. Business communications as well as personal contacts among employees insie an outsie their epartments constitute an information istribution network. Even iniviuals from ecentralize geographical locations can cooperate with each other through virtual teams creating a virtual collaboration network. These are examples of social networks inherently embee within an organization. As the computational founation of these business processes, technological networks consisting of interconnecte computers, routers, an other network evices enable the ata transmissions to perform require organizational tasks. Social networks an technological networks coexist in an organization. One salient ifference between social networks an technological networks is their structural topologies. In particular, empirical evience shows that social networks usually emonstrate non-trivial clustering an positive egree correlation (also calle assortative mixing) while most technological networks reveal lower level of clustering an negative egree correlation (Newman an Park 2003). These iversifie structural features of social networks, technological networks, an the composite organizational networks have significant influences on the organizations operational processes. While the emerging networke organizational structure increases operational efficiency tremenously, it also serves as a more vulnerable channel for malware propagation. Malware, malicious software written to cause amage to infecte computers, has evolve ramatically 3

4 since the first personal computer virus Brain surface in early Brain, a boot sector virus spreaing through infecte floppy isks, in t sprea quickly. Nor i it cause much harm. However, by showing how estructive self-replicating programs coul o, Brain herale a new era of more evastating computer viruses. Computer viruses pose a critical threat to computer users an organizations causing massive expenses in amages. It is estimate by Computer Economics that the total worlwie financial losses from malware are on average $12.18 billion per year in the perio from 1999 to 2006 (Computer Economics 2007). With the ubiquitous presence of Internet, computer viruses evelop into thousans of variants which iffer in their infection mechanism, propagation mechanism, estructive payloa an other features. From the propagation mechanism point of view, viruses can propagate through one of several ifferent vectors incluing s, instant messaging systems, P2P networks, social networking websites, LANs, WANs, etc. Some more sophisticate viruses can even propagate through multiple vectors. These vectors can be classifie into the two categories of social an technological networks as iscusse above. Hence, computer viruses can be classifie into three categories base on their propagation vectors social network (SN) base, technological network (TN) base, an composite network (CN) base. For example, MyDoom is primarily transmitte via an P2P network an therefore is a SN-base virus. Unsuspecting computer users expose more personal information an are more vulnerable to SN-base viruses. The Blaster, as an example of TN-base viruses, starts from the local machine s IP aress or a completely ranom aress an attempts to infect sequential IP aresses. Nima, a well-known multi-vector virus, spreas itself by ifferent propagation methos incluing IP probing, , network shares, etc. an therefore is a CN-base virus. 4

5 Prior research on computer viruses shows that network topology is crucial for virus propagation. In a computer virus incient, the topology of the victim network is the eterminant factor of the propagation spee an estructive consequences. Towars this irection, researchers examine network topology to enhance computer security. For example, some research uses local network measures to explain virus propagation. Kephart an White incorporate average noe egree into traitional epiemic moels (Kephart an White 1991, Kephart an White 1993). Other stuies consier specific topologies such as small-worl network (Moore an Newman 2000) an scale-free network (May an Lloy 2001, Pastor- Satorras an Vespignani 2001). Most extant work focuses on egree istributions an assumes certain istributions such as power-law istribution. However, most real worl networks are not exactly scale-free (Balthrop et al. 2004). Few research incorporates network properties of iniviual noes an examine network topology empirically. This paper empirically examines a large-scale organizational network which consists of both social network an technological network. We utilize a novel information retrieval technique to map noes in the social network to noes in the technological network to construct the composite network of the organization. We apply social network analysis to stuy the topologies of social, technological, an composite networks in an organization. We perform a comprehensive network analysis on these three networks an compare them both visually an quantitatively. Further, we statistically test the impact of the interplay of social an technological network on computer virus propagation using a susceptible-infective-recovere epiemic process. We fin that computer viruses propagate faster but reach lower level of infection through technological network than through social network, an viruses propagate the fastest an reach the highest 5

6 level of infection through the composite network. Overlooking the interplay of social network an technological network unerestimates the virus propagation spee an the scale of infection. This paper takes a social network analysis perspective to examine the computer virus propagation problem in a network organization consisting of intertwine social an technological networks. A network organization is viewe as a network where iniviuals an their computers in the organization are noes in the network, logical information communications among iniviuals form eges in the social network an physical ata transmission among iniviuals computers form eges in the technological network. Computer viruses start from certain noes an propagate through the eges an the propagation process can be consiere as a ynamic network flow built upon the unerlying social network an technological network. This paper aims to aress three research questions. First, what are the structural ifferences among social network, technological network an composite network? Secon, how oes computer virus propagate through social network, technological network, an composite network? What are the ifferences in their propagation patterns? Thir, can network structural ifferences an the interplay of social network an technological network explain ifferent virus propagation patterns? This work aresses some critical limitations of existing literature. Most extant research examines virus propagation either at the iniviual computer level or at the single network level, but not at the organizational level. Extant literature overlooks the impact of the ifferences an the interplay between social network an technological network on virus propagation. This paper proposes a holistic view of a network organization s computing environment to examine computer virus propagation patterns. Since all computers in an organization are potential virus victims an all networks, incluing social networks an technological networks, are possible 6

7 virus vectors, we view an organization as a composite of both an examine its social network an technological network simultaneously. There are intrinsic ifferences between social network an technological network which affect virus propagation. However, previous research of virus propagation an efense either oes not istinguish between social networks an technological networks or fails to consier the combine effect of the two. This paper performs a comprehensive network analysis of the three networks an compares their structural ifferences which serve as the rational of the ifferences in their virus iffusion behavior. The remainer of the paper is organize as follows. In Section 2, we iscuss the research metho an propose a multilevel structural eterminants moel for computer virus propagation. Various research questions an hypotheses are then propose to examine the virus propagation in reference to the structural properties of the networks. The following section introuces our research sample by analyzing the structural properties of the sample organization s social network, technological network, an composite network. In the section of computational analyses, we compare the virus propagation on the sample organization s social network, technological network, an composite network an report the results. Finally, we conclue the paper an iscuss possible extensions of this paper. 2. Research Moel an Hypotheses 2.1 Dynamics of Computer Viruses Propagation Most prior research in virus propagation focuses on the overall scale of computer epiemics measure by the number of total infecte computers. However, this single measure only consiers one static point in the whole virus propagation process. This simplification ignores 7

8 some important characteristics of virus propagation such as the propagation spee. In this stuy, we propose three aitional measures to capture the ynamic features of a virus propagation process. Insert Figure 1 about here Let N be the cumulative number of infections etecte at time t, t 1,, T, where T is t the maximum number of time epochs. Two groups of measures base on N t are critical to evaluate a virus incience infection time an infection number. In particular, we are intereste in two critical infection times time to takeoff ( T ), an time to equilibrium ( T ), an the corresponing infection numbers. As shown in Figure 1, the cumulative infection number typically follows an S-shape curve (Kephart an White 1991, Kephart an White 1993). Accoringly, the process of virus propagation has three stages incubation, proliferation an equilibrium. The two infection times time to takeoff ( T ) an time to equilibrium ( T ) are the two cutoff points between these stages. These infection times an their corresponing infection numbers capture the funamental characteristics of a virus propagation process an thus shoul be aopte as key control variables in information security management. A better unerstaning of when computer virus epiemics take off, when it reaches its equilibrium, an the scales in its propagation help information security managers make more informe responses as well as esign improve security policies. Therefore we use these four measures as epenent variables in our moels that follow. More formally, Table 1 gives both conceptual an operational efinitions of these variables. Insert Table 1 about here 8

9 2.2 Computer Viruses Propagation Through the Three Networks For each starting noe, we use one-way repeate measures analysis of variance (ANOVA) to examine how the propagation patterns of computer viruses iffer in various network contexts such as social networks, technological networks, an composite networks. The following moel is evelope to iscern whether the three network types have significantly ifferent virus iffusion ynamics in terms of four key measures of infection time an infection number. Specifically, let Y s s, ij j i ji ij where j enotes network type which can be SN, TN, or CN; i enotes starting noe; Y' s are epenent variables which can be T, T an N, N ; enotes the overall mean; j enotes the main effect of network type; s i enotes the effect of starting noe; the mean influence of starting noe i an network j ; an ij is ranom error. s ji represents We pose the following research questions an propose hypotheses in below regaring key measures of infection time an infection number for the three networks. Research Question 1: What are the ifferences of SN, TN, CN in terms of the key measures of infection time? Since the ensity of TN is much higher than that of SN, an CN has the highest ensity, we hypothesize that computer virus propagates the fastest in CN an then TN an SN. T T T RESEARCH HYPOTHESIS 1A:,,, SN TN CN T T T RESEARCH HYPOTHESIS 1B:,,, SN TN CN 9

10 Research Question 2: What are the ifferences of SN, TN, CN in terms of the key measures of infection number? Since the mean noe-to-noe istance of SN is shorter than that of TN, an CN has the shortest mean istance, we hypothesize that CN reaches the highest level of infection number an then SN an TN. N N N RESEARCH HYPOTHESIS 2A:,,, CN SN TN N N N RESEARCH HYPOTHESIS 2B:,,, CN SN TN 2.3 The Interplay between Social Network an Technological Network Network topology has a hierarchical structure with iniviual noes neste in subgroups. Hierarchical linear moel (HLM) is thus use to capture the neste nature of the network topology ata. In orer to examine the impact of the interplay between social network an technological network on virus propagation, we consier a hierarchical linear moel with twoway cross classification which enables us to simultaneously assess the interactive effect of iniviual-level, group-level variables of all three networks. The iniviual noes are containe within a two-way cross-classification of SN group an TN group. In the research moel, we have iniviual noes at Level 1 an SN group an TN group are cross-classifie at level 2. As shown in Figure 2 an Figure 3, we propose a two-level hierarchical linear moel with iniviual-level variables at the first level, group-level variables at the secon level while iniviuals can be cross-classifie base on SN an TN groups. Insert Figure 2 an Figure 3 about here 10

11 Iniviual Level (Level-1): Y OutDegree InDegree e ijk 0 jk 1jk ijk 2 jk ijk ijk where Y ijk s enote four measures of computer virus propagation ynamics, pjk with p 1,2 are level-1 coefficients, e ijk enote level-1 ranom effect. Outegee an inegree are two most wiely use centrality measures for iniviual noes. Outegree is efine ase the number of outgoing links from the focal noe an inegree is efine as the number of incoming links to the focal noe. We note that these two variables only epen on the focal noe an its irect neighbors an are inepenent of the rest of the network. Therefore, both outegree an inegree are local structural properties. In our moel, we specify OutDegree an InDegree to be the iniviual-level inepenent variables. Each of the level-1 coefficients pjk can be further expresse as an outcome variable in the group-level moel as follows: Group Level (Level-2): SNGroupSize *TNGroupSize b c 0 jk 0 0 b01 j SNGroupSize k 0 c01 k TNGroupSize j 0 jk k j 00 j 00k 00 jk SNGroupSize TNGroupSize b c 1 jk 1 1 b11 j SNGroupSize k 1 c11 k TNGroupSize j 1 jk k j 10 j 10k 10 jk SNGroupSize TNGroupSize b c 2 jk 2 2 b21 j SNGroupSize k 2 c21 k TNGroupSize j 2 jk k j 20 j 20k 20 jk 11

12 where 0 is the moel intercept or the gran mean, p with p 1,2 is the group mean, m with m 0,1,2 are the fixe effects of the column-specific preictor, i.e., SNGroupSize, b m1 jwith m 0,1, 2 are the ranom effects of the column-specific preictor SNGroupSize which vary across rows, i.e, ifferent TN groups, m with m 0,1,2 are the fixe effects of the row-specific preictor, i.e., TNGroupSize, c mk 1 with m 0,1, 2 are the ranom effects of the row-specific preictor TNGroupSize which vary across columns, i.e, ifferent SN groups, mjk with m 0,1,2 are the fixe effect of the cell-specific preictor SNGroupSize TNGroupSize, i.e., the cross-classification effect, b is the SN-specific error, m0 j c m0k is the TN-specific error, an is the cell-specific error. m0 jk Hence, we pose the following research questions an associate hypotheses. Research Question 3: Does the size of social network an technological network affect the key measures of the infection time associate with these networks? RESEARCH HYPOTHESIS 3A: For T, 0, T, 0, T 0 12

13 RESEARCH HYPOTHESIS 3B: FOR T, 0, T, 0, T 0 Research Question 4: Does the size of social network an technological network affect the key measures of the infection number associate with these networks? RESEARCH HYPOTHESIS 4A: FOR RESEARCH HYPOTHESIS 4B: FOR N, 0, N, 0, N 0 N, 0, N, 0, N 0 3. Research Sample We collecte empirical ata of a large-scale organization s social network, technological network, an constructe the composite network accoringly. The sample organization is one of the largest research universities in the U.S. with a total enrollment of more than 50,000 stuents. We first gathere all member ata on MySpace, the largest social networking website on the Internet, with affiliation to this university. Mining the etaile frien listing ata of each MySpace member enable us to construct the social network. We obtaine the core technological network of this university, an then mappe the social network to the technological network to erive a composite network accoring to each subject s physical location on the technological network. The following subsections give etaile escriptions of our research sample. Insert Figure 4 an Figure 5 about here 3.1 Social Network Using Perl an RegEx, we collecte ata about members of MySpace who are current stuents of the sample organization. The number of current stuent members of MySpace in February 2006 is 14,933, which accounts for more than 30% of all enrolle stuents of the sample university. 13

14 Another motivation for us to choose this ataset is that college stuents are consiere the high risk group in terms of virus infection an propagation. The relationship from one research sample on MySpace to another is uncovere by mining the etaile frien listing ata publishe in each member s online space, resulting in the social network of our research sample represente by a irecte graph as shown in Figure 4(a). 3.2 Technological Network Organizations aopt ifferent heterogeneous computing environments which involve ifferent technological networks, the most popular being LAN. These technological networks use ifferent types of topologies. The three most common topologies are the star, ring, an bus. Ethernet with bus topology ominates the LAN technology application. The sample university s technological network has a typical bus topology for its local area networks which are then linke to the core network forming a tree topology as shown in Figure 4(b). Since 2267 members out of the total 14,933 members o not reveal their subject of stuying online, the resulting technological network consists of 12,666 iniviual noes. Combine with 15 core noes of the campus network an 168 subject noes, the technological network has a combination of 12,849 total noes. A square in Figure 4(b) represents a subject noe in a builing connecte to the core network where the local networks (LANs) in each builing naturally follow the bus topology. The 168 LANs are completely connecte networks which represent a worst case scenario for the exploration of computer virus epiemics. 3.3 Composite Network 14

15 We were able to map each iniviual noe in the social network (SN) to the technological network (TN) by locating each iniviual s physical presence in the technological network. The general structure of the composite network (CN) is shown in Figure 4(c). The CN is a irecte graph which has the same number of noes as TN an two ifferent sets of eges eges from SN an eges from TN. One salient an intuitive feature of CN is that eges from SN serve as briges to connect LANs irectly. The sample social an technological networks are also visualize in Figure 5(a) an 5(b). Figure 5(a) is rawn using LaNet-vi (Alvarez-Hamelin et al. 2005). LaNet-vi is a k-core ecomposition-base visualization tool esigne for large complex networks. Figure 5(b) is rawn using Ucinet (Borgatti et al. 2002). 4. Structural an Computational Analyses Network structure is the focus of social network analysis. Social network analysis views social entities as noes an relationships as eges. Noes an eges are the two funamental elements in a network. A rich set of concepts an methos have been evelope to analyze network structures. Wassermann an Faust (1994), a popular text, provies a goo review for social network analysis. Social network analysis is wiely use in sociology, organizational stuies an other fiels. For example, it is use to analyze customer networks, inter-firm alliances, an information flow networks. In this section, we utilize social network analysis tools to examine three ifferent network context for the computer virus propagation problem. Specifically we examine three important structural properties cohesion, egree istribution an subgroup structure of social network, technological network, an composite network. 15

16 16

17 4.1 Cohesion Common cohesion measures inclue ensity, reciprocity rate, noe-to-noe istance, iameter, an reachability. We report these structural properties of SN, TN, an CN in Table 2. The SN of the sample organization has a ensity of which is much sparser than TN (with ensity 0.179) an CN (with ensity 0.184). Dya-base reciprocity rate is very high for SN (0.9943), implying that the frienship between users are mutual. Although the iameter of social network is greater than that of technological network, the mean noe-to-noe istance of social network (4.406) is much shorter. Among the three networks, CN has the smallest iameter an the shortest mean istance among the noes. Insert Table 2 about here 4.2 Degree Distribution The out-egree an in-egree measure how many outgoing or incoming eges a noe has in a network. The egree istribution escribes the variability of the noal egrees in a network. The most commonly seen egree istribution is power-law istribution. As shown in Figure 6, the social network approximately follows a power-law istribution while the technological network has a more iscrete istribution. Insert Figure 6 about here 4.3 Subgroup Structure There are cohesive subgroups embee in networks. Subgroup structure of a network refers to a partition of the network into subgroups where there are far more links within subgroups than between subgroups. In other wors, ties among the iniviual noes are concentrate insie the 17

18 subgroups rather than outsie the subgroups. Subgroup structure is a common structural property for networks incluing both social networks an technological networks (Newman an Girvan 2004). Traitional subgroup analysis techniques inclue component analysis, clique analysis, core analysis, hierarchical clustering an so on. Among them, k-core ecomposition has two salient avantages easy to compute an the resulting subgroups usually emonstrate a hierarchical structure (Alvarez-Hamelin, Dall Asta, Barrat an Vespignani 2005). Therefore we apply k-core ecomposition to analyze the subgroup structures of SN an TN, resulting in 38 SN subgroups an 168 TN subgroups. The iscovere SN groups an TN groups constitute the group-level (level-2) factor in our two-way cross-classifie HLM moel. Following the convention that the factor with more units becoming the row factor while the factor with less units becoming the column factor, we specify TN group as the row factor an SN group as the column factor in our moel. As a result, the iniviual-level (level-1) ata are containe in cells cross-classifie by the row factor (TN group) an column factor (SN group). The size of the group is the sole level-2 variable efine for each group (either SN group or TN group), enote by SNGroupSize an TNGroupSize. Figure 7 shows the istribution of group size of both social network an technological network. Insert Figure 7 about here 4.4 Computer Virus Propagation Analyses Computer virus propagation has been wiely researche using epiemiology moels. Among these epiemiology moels, SIR (Susceptible Infecte Recovere) moel is most commonly use. Researchers conuct computer simulations to analyze the virus propagation process. Following the SIR moel, we evelope computer algorithms to simulate the virus propagation 18

19 in the social network, technological network, an composite network. There are three states for each noe in the network. The noe can be susceptible, infecte, or recovere. A susceptible noe is not infecte but susceptible to virus an can be infecte by its neighbors. An infecte noe i can infect its neighbor j accoring to j s infection probability j. After trying to infect its neighbors, the infecte noe i may be recovere accoring to its recovery probability i. If the infecte noe i is recovere, then it becomes immune to future infections. In practice, we consier an infecte noe as recovere when the virus is eliminate from the computer by the user through security patching. Every infecte noe can try to infect its neighbors at all times before it is recovere. We applie the iscrete-time simulation metho to analyze the computer virus propagation process. Beginning at time 0, a single ranomly chosen noe becomes infecte an this noe starts the virus propagation process. We ranomly selecte 3000 starting noes. The propagation process stops either when the virus stops spreaing, i.e., when the number of currently infectious noes reuces to 0, or when the process runs long enough an reaches the maximum iteration number of time epoch T 100. We assume a power-law istribution of the simulation parameters i (the probability that noe i gets infecte in each infection attempt) an i (the probability that noe i gets recovere at time t 1 given that noe i is infecte at time t ). The power-law istribution captures the asymmetric nature of user behaviors. Most of the users have high infection rate an recovery rate while only few of them have low infection rate an recovery rate. We set the parameter of the exponential in the power-law istribution to an for infection rate an recovery rate respectively. The parameters are chosen such that the mean value of the infection rate an recovery rate are consistent with the empirical finings in the literature. Chen an Carley (Chen an Carley 2004) fin the ratio of infection rate to 19

20 recovery rate is between 0.01 an 0.2 with a mean of For each starting noe, we ran the simulation 20 times. Then we calculate the mean value for the number of infections an use it as the epenent variable. We ran each simulation 20 times an use the average values for the epenent variables T, T an N, N. 5. Research Results 5.1 Different Patterns of Computer Viruses Propagation Table 3 summarizes the results for the four hypotheses. Comparing computer virus propagations through the three networks, we fin that viruses propagate fastest through CN an reach the highest level of infection number. Although viruses propagate faster through TN than SN, the equilibrium infection number is higher for SN than TN. Insert Table 3 about here A repeate measures one-way ANOVA reveals that there are significant ifferences in propagation patterns of computer viruses among social network, technological network an composite network, with F ranging from to , an p.001 for all four measures of virus iffusion ynamics. LSD comparisons reveale that all three means base on three network types were significantly ifferent from each other. We fin that although computer viruses sprea slower in social network than technological network ( T, SN T, TN ), the final scale of computer infections on social network is higher than that on technological network N N (, SN, TN ). Compare with social network an technological network, computer viruses 20

21 sprea the fastest an reach the highest infection number through composite network ( T, SN T, TN T, CN an N, CN N, SN N, TN ). 5.2 Multilevel Structural Determinants of Computer Viruses Propagation As inicate in high reciprocity rate, we note that iniviual-level outegree an inegree are highly correlate. Hence, we erive reuce moels by eliminating inegree from the iniviuallevel moel to correct the multicollinearity problem an report corresponing research finings. Table 4 presents the estimation results of our moel of the multilevel structural eterminants of computer viruses propagation. Insert Table 4 about here We fin computer viruses sprea faster an eventually infect more computers if the epiemic incience starts from a noe locate in a larger technological group. The size of social groups, on the other han, oes not affect the spee or the scale of computer virus propagation irectly. Instea, subgroup structure of social network affects the scale of computer epiemics inirectly through interaction with iniviual-level centrality measures such as outegree. 6. Conclusions Extant literature on computer virus propagation unfortunately oes not examine the problem from the perspective of an organization s network structure an overlooks the interplay of social network an technological network embee within the organization. To aress this critical issue, we collecte empirical social network (SN) ata from MySpace, the largest social networking website, an mappe them to the technological network (TN) of a large organization 21

22 to construct the composite network (CN) that illustrates the effect of interplay of SN an TN. We then applie social network analysis techniques to compare an contrast the virus propagation in SN, TN, an CN. We further examine the impact of the interplay of social network an technological network on the computer virus propagation process. We fin that viruses propagate faster but reach lower level of infection through technological network than through social network, an computer viruses propagate the fastest an reach the highest level of infection through the composite network. Overlooking the interplay of social network an technological network unerestimates the virus propagation spee an the scale of infection. References Computer Economics Malware Report: The Economic Impact of Viruses, Spyware, Aware, Botnets, an Other Malicious Coe. Computer Economics. Alvarez-Hamelin, I., L. Dall Asta, A. Barrat, A. Vespignani Large scale networks fingerprinting an visualization using the k-core ecomposition. Balthrop, J., S. Forrest, M.E.J. Newman, M.M. Williamson Technological networks an the sprea of computer viruses. Science Chen, L.C., K.M. Carley The impact of countermeasure propagation on the prevalence of computer viruses. IEEE Transactions on Systems, Man an Cybernetics - Part B: Cybernetics. 34(2) Kephart, J.O., S.R. White Directe-graph epiemiological moels of computer viruses. Proceeings of the 1991 IEEE Computer Society Symposium on Research in Security an Privacy

23 Kephart, J.O., S.R. White Measuring an moeling computer virus prevalence. Proceeings of the 1993 IEEE Computer Society Symposium on Research in Security an Privacy May, R.M., A.L. Lloy Infection ynamics on scale-free networks. Physical Review E. 64(6) Moore, C., M.E.J. Newman Epiemics an percolation in small-worl networks. Physical Review E. 61(5) Newman, M.E.J., M. Girvan Fining an evaluating community structure in networks. Physical Review E. 69(2) Newman, M.E.J., J. Park Why social networks are ifferent from other types of networks. Physical Review E. 68(3) Pastor-Satorras, R., A. Vespignani Epiemic spreaing in scale-free networks. Physical Review Letters. 86(14) Sproull, L., S. Kiesler Connections: New ways of working in the networke organization. The MIT Press. Van Alstyne, M The state of network organization: A survey in three frameworks. Journal of Organizational Computing. 7(3). 23

24 Figures an Tables: Figure 1: Dynamics of Computer Virus Propagation SN Group TN Group Iniviual Noe Figure 2: Classification iagram SN Group TN Group S1 S2 S3 T1 T2 I1 I2 I3 I4 I5 I6 Iniviual Noe Figure 3: Unit iagram where iniviual noes lie within a cross-classification of SN, TN, an CN 24

25 (a) Social Network (b) Technological Network (c) Composite Network Figure 4: Topologies of Three Networks Notes: Circle represents iniviual noe; Triangle represents core noe in technological network; Square represents major noe in technological network. (a) Social Network Figure 5: Research Sample Networks (b) Technological Network Notes: In Figure 5(a), both color an size of the noes enote noal egree. Degree ecreases when the noe color changes from re to green, blue, an purple an when the noe size becomes smaller. In Figure 5(b), circle represents iniviual noe; triangle represents core noe in technological network; square represents major noe in technological network. 25

26 (a) Social Network (b) Technological Network Figure 6: Degree Distributions (a) Social Network (b) Technological Network Figure 7: Distribution of Group Sizes 26

27 Equilibrium Takeoff Table 1: Definitions of Depenent Variables Depenent Variable Conceptual Definition Operational Definition Time to Takeoff ( T ) Number of Infections at Takeoff ( N ) Time to Equilibrium ( T ) Number of Infections at Equilibrium ( N ) The time epoch with the fastest growth (largest slope) in number of infections The number of infections at time T The first time epoch when the number of infections reaches equilibrium state The number of infections at time Nt 1 N t T argmax, t {1,..., T} Nt N T Nt T N Nt T T Ntk Nt t such that 5%, min N t k 1,...,10, t {1,..., T} Table 2: Structural Properties of Three Networks Statistics Social Technological Composite Network Network Network Directe/Unirecte Directe Unirecte Directe Number of Noes 12,666 12,849 12,849 Number of Eges 105,528 2,970,324 3,066,068 Mean Degree Mean Density Reciprocity Rate Mean Noe-to-Noe Distance Diameter Reachability

28 Table 3: Comparison of Virus Propagation Differences on Three Networks Research Question Infection Time Infection Number T T N N SN Mean (SD) (.996) (3.520) (32.173) ( ) TN Mean (SD).164 (.621) (1.193) (10.568) ( ) CN Mean (SD).139 (.400) (.293) (23.395) (1.352) F p Results T, T, T, SN TN CN T, T, T, SN CN TN N, N, N, SN CN TN N, N, N, CN SN TN Table 4: Hierarchical Linear Moel Estimation Fixe Effect Ranom Effect 0 jk 1 jk Intercept 0 TN Group 0 SN Group 0 Intercept 1 TN Group 1 SN Group TN Group b 00 j SN Group c 00k Iniviual-level error ijk 1 Infection Time T T Infection Number N N Coefficient SE Coefficient SE Coefficient SE Coefficient SE Coefficient SE Coefficient SE Variance f Variance f Variance