Exploiting Temporal Complex Network Metrics in Mobile Malware Containment

Malicious mobile phone worms spread between devices via short-range Bluetooth contacts, similar to the propagation of human and other biological viruses. Recent work has employed models from epidemiology and complex networks to analyse the spread of malware and the effect of patching specific nodes. These approaches have adopted a static view of the mobile networks, i.e., by aggregating all the edges that appear over time, which leads to an approximate representation of the real interactions: instead, these networks are inherently dynamic and the edge appearance and disappearance is highly influenced by the ordering of the human contacts, something which is not captured at all by existing complex network measures. In this paper we first study how the blocking of malware propagation through immunisation of key nodes (even if carefully chosen through static or temporal betweenness centrality metrics) is ineffective: this is due to the richness of alternative paths in these networks. Then we introduce a time-aware containment strategy that spreads a patch message starting from nodes with high temporal closeness centrality and show its effectiveness using three real-world datasets. Temporal closeness allows the identification of nodes able to reach most nodes quickly: we show that this scheme can reduce the cellular network resource consumption and associated costs, achieving, at the same time, a complete containment of the malware in a limited amount of time.Comment: 9 Pages, 13 Figures, In Proceedings of IEEE 12th International Symposium on a World of Wireless, Mobile and Multimedia Networks (WOWMOM '11

Applications of Temporal Graph Metrics to Real-World Networks

Real world networks exhibit rich temporal information: friends are added and removed over time in online social networks; the seasons dictate the predator-prey relationship in food webs; and the propagation of a virus depends on the network of human contacts throughout the day. Recent studies have demonstrated that static network analysis is perhaps unsuitable in the study of real world network since static paths ignore time order, which, in turn, results in static shortest paths overestimating available links and underestimating their true corresponding lengths. Temporal extensions to centrality and efficiency metrics based on temporal shortest paths have also been proposed. Firstly, we analyse the roles of key individuals of a corporate network ranked according to temporal centrality within the context of a bankruptcy scandal; secondly, we present how such temporal metrics can be used to study the robustness of temporal networks in presence of random errors and intelligent attacks; thirdly, we study containment schemes for mobile phone malware which can spread via short range radio, similar to biological viruses; finally, we study how the temporal network structure of human interactions can be exploited to effectively immunise human populations. Through these applications we demonstrate that temporal metrics provide a more accurate and effective analysis of real-world networks compared to their static counterparts.Comment: 25 page

Dynamic communicability predicts infectiousness

Using real, time-dependent social interaction data, we look at correlations between some recently proposed dynamic centrality measures and summaries from large-scale epidemic simulations. The evolving network arises from email exchanges. The centrality measures, which are relatively inexpensive to compute, assign rankings to individual nodes based on their ability to broadcast information over the dynamic topology. We compare these with node rankings based on infectiousness that arise when a full stochastic SI simulation is performed over the dynamic network. More precisely, we look at the proportion of the network that a node is able to infect over a fixed time period, and the length of time that it takes for a node to infect half the network.We find that the dynamic centrality measures are an excellent, and inexpensive, proxy for the full simulation-based measures

A model for dynamic communicators

We develop and test an intuitively simple dynamic network model to describe the type of time-varying connectivity structure present in many technological settings. The model assumes that nodes have an inherent hierarchy governing the emergence of new connections. This idea draws on newly established concepts in online human behaviour concerning the existence of discussion catalysts, who initiate long threads, and online leaders, who trigger feedback. We show that the model captures an important property found in e-mail and voice call data – ‘dynamic communicators’ with sufficient foresight or impact to generate effective links and having an influence that is grossly underestimated by static measures based on snaphots or aggregated data

Graph Metrics for Temporal Networks

Temporal networks, i.e., networks in which the interactions among a set of elementary units change over time, can be modelled in terms of time-varying graphs, which are time-ordered sequences of graphs over a set of nodes. In such graphs, the concepts of node adjacency and reachability crucially depend on the exact temporal ordering of the links. Consequently, all the concepts and metrics proposed and used for the characterisation of static complex networks have to be redefined or appropriately extended to time-varying graphs, in order to take into account the effects of time ordering on causality. In this chapter we discuss how to represent temporal networks and we review the definitions of walks, paths, connectedness and connected components valid for graphs in which the links fluctuate over time. We then focus on temporal node-node distance, and we discuss how to characterise link persistence and the temporal small-world behaviour in this class of networks. Finally, we discuss the extension of classic centrality measures, including closeness, betweenness and spectral centrality, to the case of time-varying graphs, and we review the work on temporal motifs analysis and the definition of modularity for temporal graphs.Comment: 26 pages, 5 figures, Chapter in Temporal Networks (Petter Holme and Jari Saram\"aki editors). Springer. Berlin, Heidelberg 201

Communicability across evolving networks

Many natural and technological applications generate time ordered sequences of networks, defined over a fixed set of nodes; for example time-stamped information about ‘who phoned who’ or ‘who came into contact with who’ arise naturally in studies of communication and the spread of disease. Concepts and algorithms for static networks do not immediately carry through to this dynamic setting. For example, suppose A and B interact in the morning, and then B and C interact in the afternoon. Information, or disease, may then pass from A to C, but not vice versa. This subtlety is lost if we simply summarize using the daily aggregate network given by the chain A-B-C. However, using a natural definition of a walk on an evolving network, we show that classic centrality measures from the static setting can be extended in a computationally convenient manner. In particular, communicability indices can be computed to summarize the ability of each node to broadcast and receive information. The computations involve basic operations in linear algebra, and the asymmetry caused by time’s arrow is captured naturally through the non-mutativity of matrix-matrix multiplication. Illustrative examples are given for both synthetic and real-world communication data sets. We also discuss the use of the new centrality measures for real-time monitoring and prediction

Dynamic communicability and epidemic spread: a case study on an empirical dynamic contact network

We analyze a recently proposed temporal centrality measure applied to an empirical network based on person-to-person contacts in an emergency department of a busy urban hospital. We show that temporal centrality identifies a distinct set of top-spreaders than centrality based on the time-aggregated binarized contact matrix, so that taken together, the accuracy of capturing top-spreaders improves significantly. However, with respect to predicting epidemic outcome, the temporal measure does not necessarily outperform less complex measures. Our results also show that other temporal markers such as duration observed and the time of first appearance in the the network can be used in a simple predictive model to generate predictions that capture the trend of the observed data remarkably well.Comment: 31 pages, 15 figures, 11 tables; typos corrected; references added; Figure 3 added; some changes to the conclusion and introductio