Collaborative monitoring

TTLed RandomWalks for Collaborative Monitoring in Mobile and Social Networks

by Yaniv Altshuler

Complex network and complex systems research has been proven to have great implications in practice in many scopes... more Complex network and complex systems research has been proven to have great implications in practice in many scopes including Social Networks, Biology, Disease Propagation, and Information Security. One can use complex network theory to optimize resource locations and optimize actions.
Randomly constructed graphs and probabilistic arguments lead to important conclusions with a possible great social and financial influence.

Security in online social networks has recently become a major issue for network designers and operators. Being ``open'' in their nature and offering users the ability to compose and share information, such networks may involuntarily be used as an infection platform by viruses and other kinds of malicious software. This is specifically true for mobile social networks, that allow their users to download millions of applications created by various individual programmers, some of which may be malicious or flawed. In order to detect that an application is malicious, monitoring its operation in a real environment for a significant period of time is often required. As the computation and power resources of mobile devices are very limited, a single device can monitor only a limited number of potentially malicious applications locally. In this work, we propose an efficient collaborative monitoring scheme that harnesses the collective resources of many mobile devices, generating a ``vaccination''--like effect in the network. We suggest a new local information flooding algorithm called \emph{Time-to-Live Probabilistic Propagation} (TPP). The algorithm is implemented in any mobile device, periodically monitors one or more applications and reports its conclusions to a small number of other mobile devices, who then propagate this information onwards, whereas each message has a predefined ``Time-to-Live'' (TTL) counter. The algorithm is analyzed, and is shown to outperform the existing state of the art information propagation algorithms, in terms of convergence time as well as network overhead.
We then show both analytically and experimentally that implementing the proposed algorithm significantly reduces the number of infected mobile devices.
Finally, we analytically prove that the algorithm is tolerant to the presence of adversarial agents that inject false information into the system.