Algorithmic Game Theory and Internet Computing

1
Algorithmic Game Theoryand Internet Computing
On the Spread of Viruses on the Internet

• Information Networks
• MSE 337

2
Outline

• Short introduction on computer viruses and worms
• Models for epidemics
• SIR (susceptible-infected-removed)?
• SIS (susceptible-infected-susceptible)?
• SIS model on Scale-free networks

3
Terminology

• Virus A self replicating code that spreads by
  inserting itself into other codes and documents
• Worm Self-contained, does not need to attach
• (both names first appeared in Sci-Fi literature
  in 70s When H.A.R.L.I.E. was One by David
  Gerrold and The Shockwave Rider by John
  Brunner)?
• Other commonly used words infection, antidote,
  zombie(!), Trojan horse
• Examples Elk Coner 82, Brain 86, Melissa,
  ILOVEYOU, MyDoom
• For more information see Wikipedia

4
Modern Viruses

• Use the Internet, WWW, e-mail and file-sharing
  to spread
• After infection they may
• delete, email or encrypt files
• use computer resources (CPU, memory, network
  capacity)?
• install a backdoor zombies can be used for
• spamming (mydoom),
• DDOS attacks on a web site
• Open the door for other worms (doomjuice)?

5
Modern Viruses

• Use the Internet, WWW, e-mail and file-sharing
  to spread
• After infection they may
• delete, email or encrypt files
• use computer resources (CPU, memory, network
  capacity)?
• install a backdoor zombies can be used for
• spamming (mydoom),
• DDOS attacks on a web site
• Open the door for other worms (doomjuice)?
• They can be really costly (mydoom estimated gt
  250 million) (reward by Microsoft 250
  thousand)

6
The Code-Red Worm

• July 19, 2001 the code-red worm started
  infecting unpatched versions of Microsofts IIS
  webserver
• Worm spread by probing random IP addresses and
  infecting vulnerable hosts
• infected 359,104 hosts in 13 hours, with the
  majority of the infections occurring between
  1100 and 1630
• After 1630, the infection rate started to
  decrease due to patching, rebooting and/or
  filtering

7
Modern Viruses

• Many of the successful viruses/worms are still
  relatively dumb
• Polymorphic worms that use the network structure
  effectively can be a major threat in the future

8
Modern Viruses

• Many of the successful viruses/worms are still
  relatively dumb
• Polymorphic worms that use the network structure
  effectively can be a major threat in the future
• Polymorphic (mutating)
• list of vulnerabilities to exploit
• not possible effectively patch against them
• similar to HIV.
• Network structure the traffic will be very hard
  to detect

9
Modeling Spread of Viruses

• SIR model Susceptible-Infected-Removed
• susceptible infected
  at rate ( )?
• infected removed
  at rate 1

infectedneighbors
10
Modeling Spread of Viruses

• SIR model Susceptible-Infected-Removed
• susceptible infected
  at rate ( )?
• infected removed
  at rate 1
• removed can be interpreted as either dead or
  immune

infectedneighbors
healthy
infected removed
11
Analyzing SIR

• Very similar to our earlier analysis of the
  branching process
• Done in the previous lectures

12
Analyzing SIR

• Very similar to our earlier analysis of the
  branching process

13
Analyzing SIR

• Very similar to our earlier analysis of the
  branching process

14
Analyzing SIR

• Very similar to our earlier analysis of the
  branching process

15
Analyzing SIR

• Very similar to our earlier analysis of the
  branching process

The critical parameter the number of neighbors
infected before a node is removed
16
Modeling Mutating Worms/Viruses

• SIS model Susceptible-Infected-Susceptible
• infected healthy
  at rate 1
• healthy infected
  at rate ( )?
• Known also as Contact Process
• Studied in probability theory, physics,
  epidemiology
• Kephart and White 93 modeling the spread of
  viruses in a computer network

infectedneighbors
17
Epidemic Threshold

• Infinite graphs
• extinction weak survival
  strong survival

18
Epidemic Threshold

• Infinite graphs
• extinction weak survival
  strong survival
• Finite graphs
• logarithmic survival time

exponential (super poly)survival time
polynomial survival time
19
Epidemic Threshold

• Infinite graphs
• extinction weak survival
  strong survival
• Finite graphs
• logarithmic survival time

exponential (super poly)survival time
polynomial survival time
20
The Internet ?
21
The Sex Web
Lilijeros et. al 01
22
Epidemic Threshold in Scale-Free Network
23
Models Preferential Attachment
One vertex at a time New vertex attaches to
existing vertices
Simon 55, Barabasi-Albert 99, Kumar et
al 00, Bollobas-Riordan 00, Bollobas et al
03.
24
Epidemic Threshold in Scale-Free Network

• In Power-law networks both thresholds are zero
  almost surely! (Pastor-Satorras,Vespignani 01)
• Rigorous proof Berger, Borgs, Chayes, S. 04

25
Epidemic Threshold in Scale-Free Network

• In Power-law networks both thresholds are zero
  almost surely! (Pastor-Satorras,Vespignani 01)
• Rigorous proof Berger, Borgs, Chayes, S. 04
• Idea existence of high degree nodes
  (threshold is positive for bounded-degree
  graphs)?
• high connectivity (high degree
  nodes are usually very close)?

26
Main Theorem

• Consider a random graph in preferential
  attachment model.
• Infect vertex v chosen uniformly at random.
• Theorem With probability 1 O(?2), v is such
  that the infection survives for super-polynomial
  time with probability of order

(gt 0 for all?? gt 0)
The above expression is gt 0 for all ? gt 0 and
therefore ?c 0
27
Typical vs. Average Behavior

• Notice that we left out O(?2n) vertices in
  Theorem
• Q What is the effect of these vertices on the
  average survival probability?
• A Dramatic

28
Theorem 2. (BBCS)?

• Consider the SIS model on a preferential
  attachment graph of size n
• If the infection starts from a uniformly random
  vertex x, then the infection survives a
  super-polynomial length of time with probability
  of order

?C2
29
Typical vs. Average Behavior

• The survival probability for an infection
  starting from a typical (i.e., 1 O(??)) vertex
  is of order
• whereas, the average survival probability is of
  order

?C
due to the presence of high-degree hubs
30
Key Elements of the Proof

• For the contact process
• if maximum degree ltlt 1/??then infection dies
  quickly
• On a vertex of degree much more than 1/?2, the
  infection lives for a long time in the
  neighborhood of the vertex (star lemma)?
• For the preferential attachment
• Almost all nodes are close to a high degree node
• There is a sequence of nodes with increasing
  degrees from a typical vertex to the core of the
  graph

31
Star Lemma

• If we start by infecting the centerof a star
  with degree k the survival time is more than
• whp.
• Idea the center infects a constant fractionof
  vertices before becoming healthy.

32
Star Lemma

• X the number of infected leaves
• when the center is infected
• X ? X 1 at rate X
• X ? X 1 at rate ?
  (k X)?
• when the center is not infected
• center infected at rate ?X X ? X
  1 at rate X

X ? X Geom(?/(?1))?
33
Star Lemma

• Considering only the time when X lt ¼ ? k
• X is dominated by Y
• Y ? Y 1 at
  rate ¼ ? k
• Y ? Y 1 at
  rate ¾ ? k
• Y ? Y Geom(?/(?1)) at rate 1
• Which has an exponential survival time.

34
Key Elements of the Proof

• For the contact process
• if maximum degree ltlt 1/??then infection dies
  quickly
• On a vertex of degree much more than 1/?2, the
  infection lives for a long time in the
  neighborhood of the vertex (star lemma)?
• For the preferential attachment
• Almost all nodes are close to a high degree node
• There is a sequence of nodes with increasing
  degrees from a typical vertex to the core of the
  graph

35
Reminder (connection to Polyas urn)?

• The preferential attachment model is equivalent
  to the
• following model
• uk ?(mmu,2kmkmu) k1,2,,n

0
1
36
Reminder (connection to Polyas urn)?

• The preferential attachment model is equivalent
  to the
• following model

0
1
37
Reminder (connection to Polyas urn)?

• The preferential attachment model is equivalent
  to the
• following model

0
1
38
Reminder

• The preferential attachment model is equivalent
  to the
• following model

0
1
39
Reminder

• The preferential attachment model is equivalent
  to the
• following model

0
1
40
Corollary of Polya Urn Representation I

• Whp. the highest degree in the neighborhood k of
  a vertex v is at most
• and is at least
• For some constant ?

v
41
Corollary of Polya Urn Representation II

• For the sequence of u1, u2, , uk
• where ui1 is parent of ui we have
• Degree of uj is at least
• ?i
• For some ? gt 1

42
Proof of the Theorem
v

• Let k log (1/?)/loglog(1/?)
  
• Corollary 1 the ball of radius C1k around vertex
  v contains a vertex w of degree larger than
• (C1k)!? gt ?-5
• The infection must travel at most C1k to reach w,
  which happens with probability at least
• ?C1k
• Star lemma the survival time is more than exp(C
  ?-3 ).
• Iterate using corollary 2 until we reach a
  vertex z of sufficiently high degree for
  exp(n1/10) survival.

Log n steps
43
Containment of Epidemics
Question What is the best way to distribute a
fixed amount of antidote to contain the epidemic,
i.e. to raise the epidemic threshold of the SIS
process on preferential attachment (and more
general) graphs? 2005 Borgs, Chayes, Ganesh,
Saberi, Wilson
44
Rest of the lecture

• Another look at the definition of standard SIS
  model
• Find detailed behavior of in ?c terms of ? and
  constant recovery rate ?
• Now let ? vary from one vertex to the next, but
  assume total amount of antidote A ?n is fixed
• Q How to distribute A most effectively?

45
Standard SIS Model

• Definition of standard SIS model
• infected ! healthy at rate ?
• healthy ! infected at rate ? infected
  nhbrs
• relevant parameter ?? ?/?

46
Details of Theorem 1 ( with ?c ?c /? and ?
const)?

• For stars
• ??c ?n?1/2 o(1)?
• , amount of antidote A ?n required to suppress
  epidemic is ?n3/2 o(1) , i.e. superlinear in n
• For preferential attachment graphs
• ??c ! 0
• , amount of antidote A required to suppress
  epidemic is superlinear in n

47
Varying Recovery Rates ? ?x

• Assume there is a fixed amount of antidote A
  ?x?x to be distributed non-uniformly, dynamically
• Questions
• What is the best policy for distributing A?
• Is there a way to control the infection (i.e., to
  get ?c gt 0) on a star or preferential attachment
  graph with A scaling linearly in n?

48
Method I Contact Tracing

• Contact tracing is a method in epidemiology to
  diagnose and treat the contacts of infected
  individuals , cure / infected degree
• Theorem 3 (BCGSW) Let ?x ?? ?0ix where ix is
  the number of infected neighbors of x. Then the
  critical infection rate on the star is
• ?????????c ?n?1/3 o(1) ! 0
• Note This is an improvement from the case ?
  const
• Translation It takes A n4/3 o(1) , i.e. a
  superlinear amount, of antidote to control the
  virus via contact tracing

49
Method II Cure / Degree(vs. contact tracing
with cure / infected degree)?

• Theorem 4 (BCGSW) Let ?x dx, where dx is the
  degree of x. If ? lt 1 then the expected survival
  time is O(logn)?
• Corollary For graphs with a bounded average
  degree davg, the total amount of antidote needed
  to control the epidemic is ?davgn, i.e. linear in
  n
• Translation Curing proportional to degree is
  enough to control epidemics on general graphs
  with bounded average degree, including
  preferential attachment graphs

50
Q Can we do significantly better? I.e., can we
get ?c! 1 as n ! 1?

• A No, for expanders
• Recall a graph G (V,E) is an (?,?)-expander if
  for each subset W of V of size at most ?V, the
  number of edges joining W to its complement V\W
  is at least ??W
• Roughly speaking, an expander has large boundary
  to volume, so that quarantine methods dont work
  well

51
Expanders (cntd)?

• Theorem 5 (BCGSW) Let ? gt 0, and let Gn be a
  sequence of (?,?)-expanders on n nodes. Let ?x
  (Xt,t) obey Condition. If ? (1?)davg/(??),
  then the survival time of the infection is of
  order exp(cnlogn).
• Translation For expanders, no other
  innoculation scheme can do more than a constant
  factor better than innoculating according to
  degree

52
Summary

• On preferential attachment graphs, mutating
  viruses and worms with any positive rate of
  transmission to neighbors, and constant recovery
  rate, become epidemic with positive probability
• Contact tracing does not control the epidemic in
  the sense that it still gives ?c 0 on a star
• On general graphs, curing proportional to degree
  does control the epidemic in the sense that it
  gives ?c gt 0
• For expanders with bounded average degree, no
  other innoculation scheme works more than a
  constant factor better than curing proportional
  to degree, in the sense that nothing gives ?c ! 1

53
THE END !
54
Epidemic Threshold

• Definition infection becomes epidemic iff the
  survival time is super-polynomial in the number
  of vertices.
• Epidemic Threshold If , the
  infection has a constant chance of becoming
  epidemic.

55
Epidemic Threshold in Scale-Free Network

• In Power-law networks this threshold is zero
  almost surely!(Pastarros, Vespignani 01)
• First rigorous proof Berger, Borgs, Chayes, S.
  04
• Idea existence of high degree nodes
  (threshold is positive for bounded-degree
  graphs)?
• high connectivity (high degree
  nodes are usually very close)?

56
Lemma 1

• If we start by infecting the centerof a star
  with degree k the survival time is more than
• whp.
• Idea Look at the random variable Xt of the
  number of infected vertices attime t.

57
Main Theorem

• Consider a random graph in preferential
  attachment model.
• Choose one of the vertices uniformly at random.
• There exist C1 s.t. for large enough n and for ?
  gt 0 with probability 1 o(1), the graph is such
  that with probability larger that
• the infection survival time is at least

58
Proof
v

• For
• Reaches a vertex with degree

Log n steps
59
Open Problems

• Routing on Shortest paths
• Low-overhead decentralized mechanisms for
  detecting and fixing bad cuts
• Effect of selective curing or immunization
• More realistic models for the spread of viruses

60
THE END !