An analytical model on the propagation of modern email worms

Email worms propagate across networks by taking advantage of email relationships. Modeling the propagation of email worms can help predict their potential damages and develop countermeasures. We propose a novel analytical model on the propagation process of modern reinfection email worms. It relies on probabilistic analysis, and thus can provide a steady and reliable assessment on the propagation dynamics. Additionally, by introducing virtual users to represent the repetitious spreading process, the proposed model overcomes the computational challenge caused by reinfection processes. To demonstrate the benefits of our model, we conduct a series of experimental evaluation. The results show that our novel approach achieves a greater accuracy and is more suitable for modeling modern email worms than previous models.

Modeling worms propagation on probability

There are the two common means for propagating worms: scanning vulnerable computers in the network and sending out malicious email attachments. Modeling the propagation of worms can help us understand how worms spread and devise effective defence strategies. Most traditional models simulate the overall scale of infected network in each time tick, making them invalid for examining deep inside the propagation procedure among individual nodes. For this reason, this paper proposes a novel probability matrix to model the propagation mechanism of the two main classes of worms (scanning and email worms) by concentrating on the propagation probability. The objective of this paper is to access the spreading and work out an effective scheme against the worms. In order to evaluate the effects of each major component in our probability model, we implement a series of experiments for both worms. From the results, the network administrators can make decision on how to reduce the number of vulnerable nodes to a certain threshold for scanning worms, and how to immunize the highly-connected node for preventing worm's propagation for email worms.

Modeling propagation dynamics of social network worms

Social network worms, such as email worms and facebook worms, pose a critical security threat to the Internet. Modeling their propagation dynamics is essential to predict their potential damages and develop countermeasures. Although several analytical models have been proposed for modeling propagation dynamics of social network worms, there are two critical problems unsolved: temporal dynamics and spatial dependence. First, previous models have not taken into account the different time periods of Internet users checking emails or social messages, namely, temporal dynamics. Second, the problem of spatial dependence results from the improper assumption that the states of neighboring nodes are independent. These two problems seriously affect the accuracy of the previous analytical models. To address these two problems, we propose a novel analytical model. This model implements a spatial-temporal synchronization process, which is able to capture the temporal dynamics. Additionally, we find the essence of spatial dependence is the spreading cycles. By eliminating the effect of these cycles, our model overcomes the computational challenge of spatial dependence and provides a stronger approximation to the propagation dynamics. To evaluate our susceptible-infectious-immunized (SII) model, we conduct both theoretical analysis and extensive simulations. Compared with previous epidemic models and the spatial-temporal model, the experimental results show our SII model achieves a greater accuracy. We also compare our model with the susceptible-infectious-susceptible and susceptible-infectious- recovered models. The results show that our model is more suitable for modeling the propagation of social network worms.

Modeling and analysis on the propagation dynamics of modern email malware

Due to the critical security threats imposed by email-based malware in recent years, modeling the propagation dynamics of email malware becomes a fundamental technique for predicting its potential damages and developing effective countermeasures. Compared to earlier versions of email malware, modern email malware exhibits two new features, reinfection and self-start. Reinfection refers to the malware behavior that modern email malware sends out malware copies whenever any healthy or infected recipients open the malicious attachment. Self-start refers to the behavior that malware starts to spread whenever compromised computers restart or certain files are visited. In the literature, several models are proposed for email malware propagation, but they did not take into account the above two features and cannot accurately model the propagation dynamics of modern email malware. To address this problem, we derive a novel difference equation based analytical model by introducing a new concept of virtual infected user. The proposed model can precisely present the repetitious spreading process caused by reinfection and self-start and effectively overcome the associated computational challenges. We perform comprehensive empirical and theoretical study to validate the proposed analytical model. The results show our model greatly outperforms previous models in terms of estimation accuracy. © 2013 IEEE.

Email and knowledge creation: supporting inquiring systems and enhancing wisdom

The real promise of organizational communication technologies may lie in their potential to facilitate participative discourse between knowledge workers at all levels in distributed locations and time zones. Such discourse enables the exchange of sometimes conflicting viewpoints through which resolution and symbiosis, organizational knowledge can be built. This chapter presents a case study of a Singerian inquiring organization which illustrates how afluid dynamic community of employees can use email to build knowledge, learn, make decisions, and enhance wisdom through a cycle of knowledge combination (divergence) and knowledge qualification (convergence). The chapter offers new theoretical perspectives on the enhancement of wisdom in inquiring organizations and provides practical insights into the use of email for supporting effective knowledge creation in inquiring organizations.

Monitoring employees' email and internet use at work : balancing the interests of employers and employees.

The increased use of email and the internet in the workplace raises important legal questions for workers and employers. The purpose of this paper is to  explore some of the legal implications of use by employees of workplace email and internet systems, with particular focus on employer monitoring of the use of email and internet and its implications for employee privacy.

Enhancing email text production for users with motor impairments

People with motor impairments who use a switch device to interface with computers have poor access to affordable software for email communication. The MultiMail email package was developed with government support to provide email access solutions for these users and for others with a range of disabilities. In this paper, the development of accessible on-screen keyboards and a word prediction program which facilitates email text production is discussed. Technology solutions were informed by people with disabilities through focus group and survey data. The resulting cross-disability design of MultiMail provides innovative and cost-free solutions to email text production.

Knowledge development and creation in email

Newly created knowledge is increasingly viewed as a highly valuable source of competitive advantage for business. Email is explored in its recently recognized role as a place of organizational knowledge development and creation, employing discourse analysis of email conversations as the research approach. This paper describes a knowledge development lifecycle derived from the empirical study, and provides insight into the nature of knowledge development and creation in organizations. We found that in selected email conversations, employees naturally and intuitively build purpose driven new knowledge incrementally and iteratively, crystallizing knowledge under construction by submitting it repeatedly to a range of key stakeholders for comment, until a 'consensus' is reached regarding the outcome. Our findings identify the process of knowledge qualification in organizational knowledge creation, and suggest that organizational knowledge may be politically constructed. The research results have the potential to assist organizations in understanding and facilitating processes and conditions for knowledge creation and development. The study also highlights the potential for email as a key component in a company's formal KM strategy.

An email classification model based on rough set theory

The communication via email is one of the most popular services of the Internet. Emails have brought us great convenience in our daily work and life. However, unsolicited messages or spam, flood our email boxes, which results in bandwidth, time and money wasting. To this end, this paper presents a rough set based model to classify emails into three categories - spam, no-spam and suspicious, rather than two classes (spam and non-spam) in most currently used approaches. By comparing with popular classification methods like Naive Bayes classification, the error ratio that a non-spam is discriminated to spam can be reduced using our proposed model.

Managing email overload with an automatic nonparametric clustering approach

Email overload is a recent problem that there is increasingly difficulty people have faced to process the large number of emails received daily. Currently this problem becomes more and more serious and it has already affected the normal usage of email as a knowledge management tool. It has been recognized that categorizing emails into meaningful groups can greatly save cognitive load to process emails and thus this is an effective way to manage email overload problem. However, most current approaches still require significant human input when categorizing emails. In this paper we develop an automatic email clustering system, underpinned by a new nonparametric text clustering algorithm. This system does not require any predefined input parameters and can automatically generate meaningful email clusters. Experiments show our new algorithm outperforms existing text clustering algorithms with higher efficiency in terms of computational time and clustering quality measured by different gauges.

User perceptions and acceptance of benevolent worms - a matter of fear?

Worms and other forms of malware have been considered by IT Security firms and large companies for many years as one of the leading threats to the integrity of their data and security. However, several researchers over recent years have been working on creating worms which, instead of causing harm to machines which they infect, or the networks on which the machines reside, actually aid the network and systems administrators. Several uses of these worms have been proposed by these researchers, including, but not limited to, rapid remote patching of machines, network and system administration through use of their unique discovery and propagation methods, actively hunting, and defending against, other forms of malware such as "malevolent" worms, viruses, spyware, as well as increasing reliable communication of nodes in distributed computing. However, there has been no hint of commercial adoption of these worms, which one researcher has described as being due to a fear factor'. This paper concentrates on assessing and delivering the findings of user attitudes towards these worms in an attempt to find out how users feel about these worms, and to try and define and overcome the factors which might contribute to the fear factor'.