SAIDR: Why Traditional Epidemic Models Fail to Predict Mobile SMS Worms

TL;DR

Mobile SMS worms don't spread like the common cold. While traditional models predict a smooth explosion of infections, real-world data shows "waves" of activity. This paper introduces the SAIDR model, which accounts for the dormant habits of users and the "Trust Degree" between friends to finally match the erratic reality of mobile malware propagation.

The Gap Between Theory and Reality

For decades, researchers used SIR (Susceptible-Infected-Recovered) models to track digital viruses. These models assume that if you are "exposed," you have a constant probability of becoming "infected."

However, SMS worms like Cckun or Selfmite exploit a unique vector: Social Engineering. The authors observe that:

1. Humans are intermittent: We don't check our phones every second. We have "Active Rates" that change depending on if we are at work or sleeping.
2. Trust is Asymmetrical: You are much more likely to click a suspicious link from your mother than from a casual acquaintance.
3. Internal Defense: Some users simply never click because of high "Security Consciousness."

Methodology: The SAIDR Evolution

To bridge this gap, the authors expanded the state machine of the typical worm model.

1. New States: Affected and Dormant

• Affected (A): The "purgatory" state. A user has received the malicious SMS but hasn't opened it yet.
• Dormant (D): The "stealth" state. A phone is infected, but the user is currently inactive (sleeping/working), meaning the worm cannot propagate further from that node at that moment.

2. The Physics of Trust and Activity

The model moves away from fixed constants to dynamic variables:

• Active Rate (AR): A probability function based on real messaging datasets, showing peaks in activity (e.g., users are most active between 6:00 AM and 7:00 AM).
• Trust Degree (TD): Inspired by PageRank, this calculates the probability of infection based on the social "in-degree" of the sender.

Figure 1: The transition matrix logic from Susceptible (0) through Affected (1), Infected (2), Dormant (3), and finally Recovered (4).

Experimental Results: Matching the Waves

The breakthrough of SAIDR is its ability to replicate the multi-wave propagation curve. Traditional SEIR models produce a single, smooth "S-curve."

When tested against the Cckun worm dataset:

• Accuracy: SAIDR perfectly tracked the four distinct infection waves and three major inflection points.
• Comparison: While SIR and SEIR models massively overestimated the speed of spread, SAIDR provided a realistic temporal map of how the infection moves through a social network of 100,000 nodes.

Figure 2: The SAIDR model (dots) vs. Real-world Cckun data (solid line). Note the distinct "steps" in the curve that previous models (SIR/SEIR) completely miss.

Deep Insight: The Power of Hubs

The authors performed an Ablation Study on network topology. They found that the Degree of Initial Infected Nodes (DIIN) is the "force multiplier." If a worm starts in 8 "hub" nodes (users with many contacts), the final infection scale is nearly 70% higher than if it starts in low-degree nodes.

Conclusion & Limitations

The SAIDR model proves that human behavior is the primary variable in mobile security. A model that ignores when users sleep or who they trust is practically useless for real-world prediction.

The Catch? The model currently relies on historical datasets to calculate the "Active Rate." For a zero-day worm, predicting these rates in real-time remains a challenge. Future work should look at how these dynamics change as users shift from SMS to encrypted social apps like WhatsApp or Telegram.

Takeaway: In the fight against mobile malware, understanding the Social Network is just as important as understanding the Source Code.