Survivable strategy set design for malicious attack propagation in NEMO scenario

Abstract

Large-scale failures triggered by undesirable events such as natural disasters, massive power malfunction, and malicious attacks are attracting serious concerns in communication network infrastructure perspective. However, there have been few survivability strategy analyses in network mobility (NEMO) scenarios. To properly address this issue, this paper proposes two novel survivability strategies to handle malicious attack propagation in NEMO scenario. We use fraction of active users (FAU) to illustrate the NEMO survivability performance based on continuous-time Markov chain (CTMC) and find the relationship between survivability performance and survivable strategy when facing malicious attack in NEMO scenario. The performance analysis is helpful for us to choose the right survivable strategy in the proper time.

1 Introduction

In the previous years, the Internet has a significant impact on all aspects of modern life. It is essential to continuously provide the required data when facing natural disasters (e.g., typhoon, floods, earthquake) and intentional attacks (Distributed Denial-of-Service (DDoS) attack, power outages, worm virus) [1], especially in mobile scenarios [2]. As a consequence, the network survivability has become a significant element for network design and performance evaluation of network systems. In recent years, the survivability has greatly threatened by the network attack. According to the 2015 DDoS threat report [3], compiled by network security firm NSFOCUS, which has stated trends and methodologies of network attack in the last year, the number of DDoS attack is 179,298 in China. And the total flows of network attack go to 276,531,562 TB. Moreover, the propagation of network attack has increased significantly in mobile network communication.

The network survivability has been a critical research area of network security in the past years [4]. The term refers to the ability of a network to continue to provide services even in the presence of a failure [5]. Most studies regarding network survivability in the past primarily focus on natural disasters and massive power failures [6, 7]. In the papers [8] and [9], a continuous-time Markov chain (CTMC) model is proposed to characterize the network survivability performance in the presence of static disastrous failures and repairs, which is considered as a static disastrous event that destroys network. Authors of [10] analyzed several interesting characteristic of traffic flows in a fixed network. However, there has been little work on network survivability evaluation of network mobility.

The situations are quite different in mobile networks. Mobile networks consisted with mobile Internet devices such as smartphones, notebooks, and sensors are widely deployed in moving vehicles (buses, trains, airplanes, etc.). In order to manage continuous connectivity of an entire network as it changes its point of attachment to the Internet, network mobility basic support protocol (NEMO BSP) [11] is proposed by the Internet Engineering Task Force (IETF) to standardize the relevant procedure in this area.

In the NEMO basic protocol, there are four kinds of communication entities, namely mobile routers (MR), mobile network nodes (MNN), access routers (AR), and home agent (HA), respectively. The MR plays the role as gateways for all the MNN in the network. Besides, these MRs will be the gateway to connect MNN with the core network through AR and forwards the data traffic for the entire mobile network. More specifically, the MR and HA exchange the mobility management signaling messages once the mobile network changes its points of attachment. Due to signaling management and packets delivery, the mobile router may become the performance bottleneck and single point failure by the malicious attack.

The malicious attack propagation in a mobile network is quite different. When a malicious attack happens, the mobile network can go to the immunized state after repairing. To fill this important gap, we establish different math models of survivability in this paper and propose two different survivable strategies: delayed repair strategy and immediate repair strategy. And according to the simulation results, the right choice of survivable strategy sets has been given.

The main work and contributions of this article can be stated as follows:

• 1. The mathematical model of NEMO survivability for malicious attack propagation has been proposed.

• 2. Two different survivable strategies have been proposed to improve the outage performance of survivability in an effective way when malicious attack propagation is initiated.

• 3. The relationship between survivability performance and survivable strategy has been proposed which is helpful for making the right choice.

The rest of this paper is organized as follows: Section 2 describes the system model for malicious attack propagation. Section 3 describes the proposed strategies. Simulation results are obtained and analyzed in Section 4. Finally, conclusions are summarized in Section 5.

2 System model

In this paper, our objective is to quantify the survivability performance of malicious attack propagation in network mobility scenario; thus, the definition of survivability framework presented by ANSI T1A1.2 committee has been adopted [12]. As shown in Fig. 1, the survivability performance is illustrated in the y-axis while the x-axis indicates the time. In addition, we give several attributes to illustrate the behavior of survivability. The measure of interest M is supposed as the performance metrics of the loss probability in our paper. Before an attack occurs, the measure of interest M has the value m ₀; m _a is the value of M just after the attack arrives; m _u is the maximum difference between the value of M and m _a after the attack arrives; m _r is the recovery value of M after the time t _r ; and t _R is the relaxation time for the network to recover the value of m _0.

Fig. 1

Illustration of survivability (adapted from [7])

In our paper, it is assumed that a certain network infrastructure consists of several core network and access network. Take the access network as an example, its topology can be easily derived according to network architecture. In our analysis, the node in the topology is represented as a mobile subnet. At time t, there are three different states. When the subnet has been attacked, it is infected, which is called as infected state (IN for short). We classify the healthy state into two different kinds: one is susceptible state (SP for short) which is the initial state of a subnet and the other is the immunized state (IM for short) which means it cannot be attacked using the same approach.

Let a random variable Y _j (t) denote a state of node j at the discrete time t. Then, we have

$$ {Y}_j(t)=\Big\{\begin{array}{l}\mathrm{I}\mathrm{N},\mathrm{Infected}\\ {}\mathrm{H}\mathrm{Y},\mathrm{Healthy}\Big\{\begin{array}{l}\mathrm{S}\mathrm{P},\mathrm{Susceptible},\\ {}\mathrm{I}\mathrm{M},\mathrm{Immunizied}.\end{array}\operatorname{}\end{array}\operatorname{} $$

(1)

Figure 2 illustrates the state transition diagram of node j. When node j starts at SP state, it can either transmit to IM state with the attack repair rate (ARR) μ(t) or IN state with the attack arrive rate (AAR) λ(t). Thus, if the state of the node is IN, it can just transfer to IM state with the ARR μ(t). Once the node is repaired, it will stay at IM state. Furthermore, no matter which kind of state the node stay at, it may transfer to IM state finally.

Fig. 2

State transition diagram of one node

We use a directed graph to model the malicious propagation procedure. This directed graph includes nodes, which represent mobile subnets (MoSN for short), and directed edges, which represent the possible propagation directions among different MoSNs. Using a mathematical model, we evaluate the network survivability performance of MoSN from attack arriving, attack propagation, and through to the process of repairment finished.

It is assumed that the process of attack propagation can be described as a continuous-time stochastic process. The state of the network system can be totally illustrated by the collection of the state of each MoSN. At any time t, the state Y(t) can be denoted by a n-dimensional vector as follows:

$$ Y(t)=\left({Y}_1(t),{Y}_2(t),\dots {Y}_m(t),\dots {Y}_n(t)\right),t\ge 0,1\le m\le n, $$

(2)

where for each MoSN 1 ≤ m ≤ n, Y _m (t) describes the level of mth MoSN state at time t. There are three different states that the mth MoSN could remain at. Y _m (t) = 1 represents that the state of mth MoSN is in the SP state at time t and the attack has not arrived at time t; Y _m (t) = 0 indicates that the mth MoSN is in the IN state at time t and the attack has arrived. Y _m (t) = 1 ' means that the mth MoSN has been restored to the IM state at time t. Furthermore, the last state is an absorbing state of all three ones. Based on the above assumption, Y _m (t) can be described as follows:

$$ {Y}_m(t)=\left\{\begin{array}{l}1,\kern0.5em \mathrm{if}\kern0.5em \mathrm{the}\kern0.5em \mathrm{node}\kern0.5em \mathrm{is}\kern0.5em \mathrm{in}\kern0.5em \mathrm{the}\kern0.5em \mathrm{S}\mathrm{P}\kern0.5em \mathrm{state}\\ {}0,\kern0.5em \mathrm{if}\kern0.5em \mathrm{the}\kern0.5em \mathrm{node}\kern0.5em \mathrm{is}\kern0.5em \mathrm{in}\kern0.5em \mathrm{the}\kern0.5em \mathrm{I}\mathrm{N}\kern0.5em \mathrm{state}\\ {}1\hbox{'},\kern0.5em \mathrm{if}\kern0.5em \mathrm{the}\kern0.5em \mathrm{node}\kern0.5em \mathrm{is}\kern0.5em \mathrm{in}\kern0.5em \mathrm{the}\kern0.5em \mathrm{I}\mathrm{M}\kern0.5em \mathrm{state}\end{array}\right.\kern0.5em . $$

(3)

Generally, the attack is assumed initially to occur on the first MoSN. In addition, the attack and repair transition is only determined by the current state of MoSN and has nothing to do with the path to the current state. It is assumed that the time of attack is exponentially distributed. Since AAR and ARR are temporarily independent, it can be modeled using Poisson distribution.

According to the above assumptions, the transition process of all the MoSN can be completely modeled as a temporally CTMC on the state space S. The state space S is composed of a total of N = 3ⁿ states as below:

$$ S=\left\{\left({Y}_1,{Y}_2,\dots, {Y}_n\right),{Y}_1,{Y}_2,\dots, {Y}_n\in \left(0,1,1{\textstyle \hbox{'}}\right)\right\}. $$

(4)

For each time t ≥ 0, the probability F _k (t) that the MoSN is in state k of transient process S can be defined as follows:

$$ {F}_k(t)={P}_r\left\{Y(t)=k\right\},k\in S. $$

(5)

Let

$$ f(t)=\left[{f}_1(t),{f}_2(t),\dots, {f}_N(t)\right] $$

(6)

denote a row vector of transient state probability of Y(t). When the network system is in state k ∈ S, a reward rate γ(k) can be assigned, where γ is defined as a reward function. The vector of reward rates associated with the state can be denoted as follows:

$$ \varUpsilon =\left[{\varUpsilon}_1,{\varUpsilon}_2,\dots, {\varUpsilon}_N\right]. $$

(7)

Suppose the probability of propagation from state i to state j is denoted by p _ij , the transition rate matrix of the process S could be expressed in matrix form as

$$ P=\left(\begin{array}{ccccc}\hfill {p}_{11}\hfill & \hfill \cdots \hfill & \hfill {p}_{1k}\hfill & \hfill \cdots \hfill & \hfill {p}_{1N}\hfill \\ {}\hfill \vdots \hfill & \hfill \ddots \hfill & \hfill \vdots \hfill & \hfill \ddots \hfill & \hfill \vdots \hfill \\ {}\hfill {p}_{k1}\hfill & \hfill \cdots \hfill & \hfill {p}_{kk}\hfill & \hfill \cdots \hfill & \hfill {p}_{kN}\hfill \\ {}\hfill \vdots \hfill & \hfill \ddots \hfill & \hfill \vdots \hfill & \hfill \ddots \hfill & \hfill \vdots \hfill \\ {}\hfill {p}_{N1}\hfill & \hfill \cdots \hfill & \hfill {p}_{Nk}\hfill & \hfill \cdots \hfill & \hfill {p}_{NN}\hfill \end{array}\right). $$

(8)

Table 1 summarizes the general rules for constructing the infinitesimal generator matrix of mode for a network with a general number of MoSN.

Table 1 The rules for constructing the generation matrix

For the sake of calculating f(t), the Kolmogorov differential equation written in the matrix form should meet as follows:

$$ \frac{df(t)}{dt}=f(t)P. $$

(9)

After that, we can get the probability vector of the state

$$ f(t)=f(0){e}^{Pt}. $$

(10)

In this paper, it is assumed that the survivability performance is regarded as equal to the network connectivity, which is the fraction of active MoSN in the network system. Thus, the expected instantaneous reward rate E[H(t)] gives the average connectivity of the system at time t as follows:

$$ E\left[H(t)\right]={\displaystyle \sum_{j\in S}{\gamma}_j}{f}_j(t). $$

(11)

However, different to fixed network, the most significant aspect of the mobile network is that it should consider the mobility factor. Therefore, we define the dwell time of subnet k as t _k to represent the mobility. Due to its memoryless property, the dwell time of subnet k + 1 has no relationship with the dwell time of subnet k.

We assume t _k follows exponentially distributed with mean value 1/α

$$ f(t)\left\{\begin{array}{c}\hfill \alpha {e}^{-\alpha t}\left(t>0\right)\hfill \\ {}\hfill 0\left(t\le 0\right)\hfill \end{array}\right.. $$

(12)

The parameter α represents the moving speed of the subnet. When α = 0, it represents the fixed subnet. With the increase of α, the mobility becomes higher and more dynamic.

In our paper, we analyze two different strategies to repair the infected subnet. One is delayed repair strategy (DRS) and the other is immediate repair strategy (IRS). In DRS, the repairing action will start only after that all the subnets has been infected. While in IRS, the repairing action will start immediately as soon as the subnet has been infected. The following will be described in details.

As shown in Fig. 3, in DRS, the subnet starts to enter area 1 and stays for the dwell time t _d1, then leaves for the area 2. Assuming that the attack will occur during this time period, the time interval between the attack start time and the attack end time is t _λ1. Only if t _λ1 is less than t _d1 could the subnet be attacked. Otherwise, the subnet will leave area 1 and it therefore cannot be attacked.

Fig. 3

The timing diagram for DRS

So the probability of mobile subnet attack can be defined as

$$ {p}_{10}=p\left({t}_d>{t}_{\lambda}\right)={\displaystyle {\int}_{t_{\lambda}}^{+\infty}\alpha {e}^{-\alpha t}dt={e}^{-\alpha {t}_{\lambda }}}. $$

(13)

After all the subnets have been attacked, they can be repaired during the dwell time ${t}_{d_k}.$ Assume that the time interval between the repair start time and the repair end time is ${t}_{\mu_k}.$ Only if ${t}_{\mu_k}$ is less than ${t}_{d_k}$ could the subnet be repaired in area k. Otherwise, it cannot be repaired successfully in area k. So the probability of mobile subnets repair can be defined as

$$ {p}_{1{0}^{\prime }}=p\left({t}_d>{t}_{\mu}\right)={\displaystyle {\int}_{t_{\mu}}^{+\infty}\alpha {e}^{-\alpha t}dt={e}^{-\alpha {t}_{\mu }}}. $$

(14)

The timing diagram for IRS is depicted by Fig. 4. The IRS model is quite different from the DRS model. Once the subnet attack happens, it will start to repair this subnet. Only if the sum of t _λ and t _μ is less than t _d will the subnet be repaired successfully in the area. Otherwise, it cannot be repaired successfully in the area. As a result, the probability of mobile subnet attack is the same as the DRS model. However, the probability of mobile subnet repair is different, and it can be defined as follows:

Fig. 4

The timing diagram for IRS

$$ {p}_{1{0}^{\prime }}=p\left({t}_d>{t}_{\lambda +\mu}\right)={\displaystyle {\int}_{t_{\lambda +\mu}}^{+\infty}\alpha {e}^{-\alpha t}dt={e}^{-\alpha {t}_{\lambda +\mu }}}. $$

(15)

3 Attack scenario evaluation

As shown in Fig. 5, there is an infrastructure of network system deployed in a certain geographical area, which can be divided into two parts: the core network and the access network. The access network is composed by a set of MoSN, and it can forward the packets to the core network using multiple access routers (AR).

Fig. 5

Attack scenario in the NEMO scenario

There can be three different types of nodes in MoSN: one is local fixed nodes (LFNs), and the other two are local mobile nodes (LMNs) and visiting mobile nodes (VMNs). With respect to MN, LFN does not move to other networks, while LMN can move to other networks and usually reside in MoSN. VMN is from another network and attaches to MN. VMNs and LMNs are referred as mobile nodes, and they are MIPv6 capable. The MR attaches MoSN to the core network through AR.

For simplicity, the network system which consists of n = 2 MoSN is considered in this paper. It is assumed that the propagation of attack occurred from the first MoSN to the second MoSN in successive steps.

According to the above assumption, the transient state can be described as double as (Y1, Y2), where Y _j  ∈ {0, 1, 1 '}, j = 1, 2. Then, the set of the state space S can be denoted as follows: S ₀ = (11), S ₁ = (01), S ₂ = (10), S ₃ = (1 ′ 1), S ₄ = (00), S ₅ = (11 ′), S ₆ = (1 ′ 0), S ₇ = (01 ′), S ₈ = (1 ′ 1 ′).

In our survivability model, the rate of the initial event is out of consideration. Suppose the AAR of ith MoSN is λ′ _i , the ARR is μ _i ' and the initial state of the network system is (11).

When the attack arrives at the first MoSN, all the terminals in MoSN will disconnect from the core network. With the AAR λ′₁, the initial state can be transferred to state (01). It is the same for the second MoSN. With the AAR λ′₂, the initial state can be transferred to state (10). To demonstrate our proposed model, two strategies are considered:

3.1 Delayed repair strategy

In this strategy, only if all of the subnets have been infected, it will go into repair mode. When the state of subnet is staying at (01) or (10), the state can be transferred to state (00) and the impact of the network attack propagation from the first MoSN to the second MoSN should be taken into account.

As depicted in Fig. 6, if the state of the subnet stays at (01), the network attack arrives at the second MoSN, and then all of the users in the second MoSN will disconnect to the core network. The state will go to state (00) with the AAR λ′₂. If the state of the subnet stays at (10), the network attack arrives at the first MoSN, and then all of the users in the first MoSN will disconnect to the core network. The state will transfer to state (00) with AAR λ′₁.

Fig. 6

State-transition rate diagram of DRS

When all the subnets have been transferred to the state (00), the system could start its repair model. There are two kinds of possible states the system can choose. With the ARR μ _1′, it may transit to state (1′0) which represents that the first MoSN is repaired. However, if the second MoSN is repaired, it may transit to state (01′) with the ARR μ _2′. Finally, once all of the subnets in the network system have been repaired, they will transfer to the immunized state (1′1′).

When the subnet is in the NEMO scenario, the probability of mobile subnet attack or repair should be taken into the consideration.

In the DRS model, once the mobile subnet has been attacked successfully, the damage rate should multiply by the probability of mobile subnet attack; if the MN has been repaired successfully, the repair rate should multiply by the probability of mobile subnet repair as follows:

$$ \begin{array}{l}{\lambda}_1\hbox{'}={\lambda}_1{p}_{10}={\lambda}_1{e}^{-\alpha {t}_{\lambda_1}}\\ {}{\lambda}_2\hbox{'}={\lambda}_2{p}_{10}={\lambda}_2{e}^{-\alpha {t}_{\lambda_2}}\\ {}{\mu}_1\hbox{'}={\mu}_1{p}_{01\hbox{'}}={\mu}_1{e}^{-\alpha {t}_{\mu_1}}\\ {}{\mu}_2\hbox{'}={\mu}_2{p}_{01\hbox{'}}={\mu}_2{e}^{-\alpha {t}_{\mu_{{}_2}}}.\end{array} $$

(16)

Based on Eqs. 8 and 16, the matrix P is defined as the infinitesimal generator matrix of the CTMC. Thus, we can describe the dynamic behavior using the Kolmogorov differential-difference equation in matrix form as follows:

$$ P=\left(\begin{array}{ccccccccc}\hfill \hbox{-} {\lambda}_1\hbox{'}\hbox{-} {\lambda}_2\hbox{'}\hfill & \hfill {\lambda}_1\hbox{'}\hfill & \hfill {\lambda}_2\hbox{'}\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill \\ {}\hfill 0\hfill & \hfill \hbox{-} {\lambda}_2\hbox{'}\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill {\lambda}_2\hbox{'}\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill \\ {}\hfill 0\hfill & \hfill 0\hfill & \hfill \hbox{-} {\lambda}_1\hbox{'}\hfill & \hfill 0\hfill & \hfill {\lambda}_1\hbox{'}\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill \\ {}\hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill \\ {}\hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill \hbox{-} {\mu}_1\hbox{'}\hbox{-} {\mu}_2\hbox{'}\hfill & \hfill 0\hfill & \hfill {\mu}_1\hbox{'}\hfill & \hfill {\mu}_2\hbox{'}\hfill & \hfill 0\hfill \\ {}\hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill \\ {}\hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill \hbox{-} {\mu}_2\hbox{'}\hfill & \hfill 0\hfill & \hfill {\mu}_2\hbox{'}\hfill \\ {}\hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill \hbox{-} {\mu}_1\hbox{'}\hfill & \hfill {\mu}_1\hbox{'}\hfill \\ {}\hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill \end{array}\right). $$

Based on the convolution approach, we can obtain the transient probability f _j (t), j = 0, …, 8 in a closed-form as follows:

$$ \frac{d{f}_1(t)}{dt}=-\left({\lambda}_1\hbox{'}+{\lambda}_2\hbox{'}\right){f}_1(t) $$

(17)

$$ \frac{d{f}_2(t)}{dt}={\lambda}_1\hbox{'}{f}_1(t)-{\lambda}_2\hbox{'}{f}_2(t) $$

(18)

$$ \frac{d{f}_3(t)}{dt}={\lambda}_2\hbox{'}{f}_1(t)-{\lambda}_1\hbox{'}{f}_3(t) $$

(19)

$$ \frac{d{f}_5(t)}{dt}={\lambda}_2\hbox{'}{f}_2(t)+{\lambda}_1\hbox{'}{f}_3(t)-\left({\mu}_1\hbox{'}+{\mu}_2\hbox{'}\right){f}_5(t) $$

(20)

$$ \frac{d{f}_7(t)}{dt}={\mu}_1\hbox{'}{f}_5(t)-{\mu}_2\hbox{'}{f}_7(t) $$

(21)

$$ \frac{d{f}_8(t)}{dt}={\mu}_2\hbox{'}{f}_5(t)-{\mu}_1\hbox{'}{f}_8(t) $$

(22)

$$ \frac{d{f}_0(t)}{dt}={\mu}_2\hbox{'}{f}_7(t)+{\mu}_1\hbox{'}{f}_8(t) $$

(23)

3.2 Immediate repair strategy

In this strategy, once one of the subnets has been infected, it will switch to repair model. As shown in Fig. 7, once one of the subnets has been transferred into the state 0, it will start to repair the subnet, until the subnet changed into the immunized state. Suppose the first attack arrives at the first MoSN, and the state of subnets goes into (01). In this case, the network system starts to repair the model immediately. As the result, it can be transited into the state (1′1) with the ARR μ ₁′. Then, the attack arrives at the second MoSN, the state will transfer from (1′1) to (1′0) with the AAR λ ₂′. It is the same to the other case. When the first attack arrives at the second MoSN, and the state of the subnets goes into (10), the state of the subnets will soon transit into (1′0). No matter which kinds of states the system stays at, it will jump into the absorbing state finally.

Fig. 7

State-transition rate diagram of IRS

Similar to the DRS model, the probability of mobile subnet attack or repair should be considered. As a result, the new damage rate and repair rate are as follows:

$$ \begin{array}{l}{\lambda}_1\hbox{'}={\lambda}_1{p}_{10}={\lambda}_1{e}^{-\alpha {t}_{\lambda_1}}\\ {}{\lambda}_2\hbox{'}={\lambda}_2{p}_{10}={\lambda}_2{e}^{-\alpha {t}_{\lambda_2}}\\ {}{\mu}_1\hbox{'}={\mu}_1{p}_{01\hbox{'}}={\mu}_1{e}^{-\alpha {t}_{\lambda 1+\mu 1}}\\ {}{\mu}_2\hbox{'}={\mu}_2{p}_{01\hbox{'}}={\mu}_2{e}^{-\alpha {t}_{\lambda 2+\mu 2}}.\end{array} $$

(24)

Thus, it takes the form of the transition matrix as follows:

$$ P=\left(\begin{array}{ccccccccc}\hfill -{\lambda}_1\hbox{'}-{\lambda}_2\hbox{'}\hfill & \hfill {\lambda}_1\hbox{'}\hfill & \hfill {\lambda}_2\hbox{'}\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill \\ {}\hfill 0\hfill & \hfill -{\mu}_1\hbox{'}\hfill & \hfill 0\hfill & \hfill {\mu}_1\hbox{'}\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill \\ {}\hfill 0\hfill & \hfill 0\hfill & \hfill -{\mu}_2\hbox{'}\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill {\mu}_2\hbox{'}\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill \\ {}\hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill -{\lambda}_2\hbox{'}\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill {\lambda}_2\hbox{'}\hfill & \hfill 0\hfill & \hfill 0\hfill \\ {}\hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill \\ {}\hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill -{\lambda}_1\hbox{'}\hfill & \hfill 0\hfill & \hfill {\lambda}_1\hbox{'}\hfill & \hfill 0\hfill \\ {}\hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill -{\mu}_2\hbox{'}\hfill & \hfill 0\hfill & \hfill {\mu}_2\hbox{'}\hfill \\ {}\hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill -{\mu}_1\hbox{'}\hfill & \hfill {\mu}_1\hbox{'}\hfill \\ {}\hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill \end{array}\right) $$

Similarly, based on the convolution integration approach, we can obtain the transient probability in a closed-form as follows:

$$ \frac{d{f}_1(t)}{dt}=-\left({\lambda}_1\hbox{'}+{\lambda}_2\hbox{'}\right){f}_1(t) $$

(25)

$$ \frac{d{f}_2(t)}{dt}={\lambda}_1\hbox{'}{f}_1(t)-{\mu}_1\hbox{'}{f}_2(t) $$

(26)

$$ \frac{d{f}_3(t)}{dt}={\lambda}_2\hbox{'}{f}_1(t)-{\mu}_2\hbox{'}{f}_3(t) $$

(27)

$$ \frac{d{f}_4(t)}{dt}={\mu}_1\hbox{'}{f}_2(t)-{\lambda}_2\hbox{'}{f}_4(t) $$

(28)

$$ \frac{d{f}_6(t)}{dt}={\mu}_2\hbox{'}{f}_3(t)-{\lambda}_1\hbox{'}{f}_6(t) $$

(29)

$$ \frac{d{f}_7(t)}{dt}={\lambda}_2\hbox{'}{f}_4(t)-{\mu}_2\hbox{'}{f}_7(t) $$

(30)

$$ \frac{d{f}_8(t)}{dt}={\lambda}_1\hbox{'}{f}_6(t)-{\mu}_1\hbox{'}{f}_8(t) $$

(31)

$$ \frac{d{f}_0(t)}{dt}={\mu}_2\hbox{'}{f}_7(t)+{\mu}_1\hbox{'}{f}_8(t) $$

(32)

4 Performance analysis

In this section, we analyze the numerical results of two strategies. For the sake of illustrating the applicability of the above method, the worm propagation is adopted to evaluate the network system survivability performance.

First, we apply and compare DRS and IRS for the four different values of attack propagation rates schemes in each strategy. The first is called the fast propagation fast repair scheme (FF for short), which means its AAR is high and its ARR is low. Similarly, the other three are fast propagation slow repair scheme called FS, slow propagation fast repair scheme called SF, and slow propagation slow repair scheme called SS. Then, we compare different strategies of one scheme and discuss the proper survivable strategy for malicious attack propagation in NEMO scenario.

We use reward rate E[H(t)] in Eq. 11 to measure the system survivability performance, which is described by the impact of active users at time t. In the system, we define the normal value as all the MoSNs in the system have been repaired, and the fraction of active of users is 1. Two subnets are considered in the analysis. They consist of 150 hosts and 200 hosts, respectively, since the maximum host supported by a subnet is usually 255.

For parameter setting of the AAR and ARR, we refer to the data from [13]. It is believable that the value of AAR is more than 2 orders of magnitude than the value of ARR, and the unit of repair time is in hours. Based on the different rates of attack propagation and repair, we study four different propagation schemes to study the impact on survivability performance. For simplicity, the high rates of AAR or ARR are three times of low rates. In doing so, our model parameters can represent the behavior of typical real network system.

As displayed in Table 2, we define four different schemes based on setting different propagation rates and repair rates.

Table 2 Parameters setting

One result is summarized in Fig. 8, where the chosen repair strategy is DRS. From Fig. 8a, b, we can easily get that if the repair speed is the same, it will have the same fraction of active users (FAU) in the final. Different malicious attack propagation rates will have the same impact on the active users in the beginning. Comparing Fig. 8a with Fig. 8d, it is easily known when MoSNs have the same attack propagation rates, the performance of the system survivability is better if it has the higher repair speed. Different repair speed will have the impact on the time of system back to the normal value. Comparing Fig. 8b with Fig. 8c when repair speed is higher, it could have the higher FAU at the same time.

Fig. 8

Survivability impact of different schemes (a–d) in DRS

As shown in Fig. 8, when malicious propagation rate is faster, it will have the lower FAU at start. When the moving speed of MoSN is getting higher, FAU decreases. The reason is that mobility increases the difficulty of repairing MoSN. Even worse, in Fig. 8c, d, when the moving speed increases to the certain value, FAU will stay at very low value. It is possible, if the moving speed is extremely high, the MoSN in the system could not be repaired to the IM state. The reason is that the time of repairing to the IM state is beyond the limit of MoSN dwell time.

Figure 9 shows the result of IRS. In the DRS strategy, FAU keeps the certain value in the beginning. It is not affected by the increasing of the attack propagation rates. As time passed by, all the MoSNs will be repaired to the IM state and the system will be back to the normal value. Similar to the DRS strategy, the system could not be recovered to the normal value. Different from DRS strategy, FAU increases in the beginning but soon afterwards has the trend of declining. It means that the mobility of MoSN is helpful to improve the performance of the system survivability at the initial stage. The reason goes to that damage time of MoSN exceeds the range of MoSN dwell time. Therefore, the attack to MoSN has not become effective in the beginning. However, as time goes on, the mobility has prolonged the time of the system back to the normal value.

Fig. 9

Survivability impact of different schemes (a–d) in IRS

To better understand of the difference between DRS and IRS, we choose the same scheme of two strategies. As depicted in Fig. 10, the system survivability of different moving speeds in the SF scheme is given. It is easy to get that as the moving speed increase, it has the same effect on the fraction of users in the two strategies. As the moving speed is getting bigger, MoSN is getting more difficult to transfer to the IM state. As a result, the system has less active users at the same time. There is another important thing can be drawn from Fig. 9. Compared to DRS, IRS has better survivability performance in the beginning, but it has to spend much more time repairing to the normal value. The reason for this is that MoSN starts to repair as soon as it has been attacked in IRS. However, according to the model stated before, the time of MoSN being repaired to IM state in IRS is more than that in DRS. As a result, it is more difficult for the system in IRS to repair to the normal value.

Fig. 10

Survivability impact of two strategies

Finally, we can summarize two useful results from the above. In IRS, the system spends much more time repairing to the normal state but has the higher FAU at the beginning stage. Therefore, IRS is applicable for the system to keep the fine survivability performance in a certain time. Another conclusion is that the system under the DRS spends less time repairing to the normal value. Therefore, DRS could be applied to the system which should achieve better survivability performance after some time.

5 Conclusions

In this paper, we have presented two new survivable strategies when facing malicious attack propagation in NEMO scenario. In our approach, we use CTMC analytical model to compare two strategies by analyzing their dynamic behaviors. Simulation results have demonstrated that DSR provides less repair time for IM state in the NEMO scenario. Moreover, our results suggested how to set the proper survival strategy for system with higher FAU. For the future work, it would be helpful to add optimization considerations [14, 15] into current survivability research and extend our analysis to more general mobile network scenarios.